Thanks for pointing me in the right direction.
The only place I can see NAT Traversal is for the VPN Gateway (VPNs/AutoKey Advanced/Gateway/Edit/Advanced).
I've tried enabling that, yet it doesn't seem to make any difference: Tunnel still comes up, but no traffic. Is there somewhere else I should be enabling NAT Traversal?