Hello Tural,
the FWSM is like a separate device within your C6500 anatomy
the best way to advertise NAT pools should be the following:
on supervisor/MSFC you configure static routes for the NAT pools with IP next hop = FWSM outside L3 interface
under router bgp you add network statements that match exactly (including the network mask) the static routes defined for the NAT pools.
Traffic coming from the internet has to be routed to FWSM outside interface, the FWSM will perform NAT and after it can route again to the MSFC on the FWSM inside to reach the inslde local addresses.
On the opposite direction the opposite should happen:
traffic from internal networks have to be routed to the FWSM in order to have NAT to be performed.
In order to achieve this, the detailed BGP table has to be separated from internal network otherwise the traffic will try to go to the internet bypassing the FWSM and NAT operation.
To achieve this (the internal networks facing interfaces and FWSM inside) and ( the interfaces facing the ISPs and the FWSM outside) have to be associated to different VRFs = two different routing tables.
Example:
VRF INSIDE include interfaces facing the internal network and the FWSM inside
You run in VRF your IGP to learn about internal routes and you configure a static default route in VRF INSIDE pointing to the FWSM inside interface.
On the FWSM you configure static routes for internal networks pointing to MSFC SVI connected to the FWSM inside interface.
On the FWSM you configure the static default route pointing to the MSFC SVI in the outside interface, this SVI is in global routing table.
In this example interfaces facing the ISPs and the one facing the FWSM outside are left in global routing table.
The FWSM creates communication between the two separated routing tables. But use of the VRFs is mandatory to avoid NAT bypass.
Hope to help
Giuseppe
