Migrating from a Cisco Pix 501 firewall to a Netgear FVS336G firewall

Question

We are in the process of migrating our firewalls from a Cisco Pix 501 to a Netgear FVS336G, due to age, capacity, and Windows 7 not supporting the VPN software. The firewall provides DHCP, outgoing internet and incoming VPN (I’m not sure which protocols). No other types of connections are required.

We are also using a Netgear DG834G Wireless ADSL firewall router as an ADSL modem. NAT is disabled, but the firewall appears to be up.

We have 6 external IP addresses (host1-host6, with the Cisco being host5), and the ADSL router is configured to treat the Cisco firewall as the DMZ server. As I understand it, this means that all unknown incoming protocols get routed to the PiX.

Is it possible to run both firewalls in parallel, with the NetGear firewall providing DHCP, outgoing internet and VPN to newly configured clients, and the Cisco providing only VPN to old clients, as in the diagram below?

                               +------+   +----+
                      IP=Host5 | PiX  |   |    |
          +--------+   +-------| Fire |---|    |
          |        |   |       | wall |   | R  |
Internet  | ADSL   |   |       +------+   | o  |
----------| ROUTER |---+ <IP=Host6        | u  |
IP        |        |   |       +------+   | t  |
x.x.x.x   +--------+   |       | NetG |   | e  |
                       +-------| Fire |---| r  |
                      IP=Host1 | wall |   |    |
                               +------+   +----+

If so, could we simply leave the Cisco and ADSL routers alone, and setup the Netgear firewall on a different IP address (host1), or would I need to configure the ADSL router to route different protocols to different IP addresses?

As a halfway step, do I simply turn off the firewall on the ADSL router, and configure the NetGear as required?

Also, how do I disable the DHCP server, etc in the Pix? From a bit of random googling, the following appears like it should work. Is this correct?

conf t
clear dhcpd
wr m

Answer 1

Assuming your DG834G is just routing and not acting as a firewall, originating VPN connections should be OK because the client will contact the PIX external IP address (host5), not the netgear (host6). However you say 'dmz server' so I'm not sure what that means in this case...

I think one issue will be what happens to the traffic between a VPN client outside and a server on the inside. The Cisco is presumably the VPN endpoint so traffic gets decrypted on the pix. This traffic then gets forwarded (in clear) to the server, which replies. This reply needs to be routed to the pix for encryption, not the netgear - so how does the inside router know which traffic is vpn traffic and which isn't? If your cisco vpn is giving clients an IP address from an address pool then you need this to be from an address pool different to your internal network - that way you can just put a route into the inside router to direct such traffic to the pix. That probably means you need a dhcp server running on the pix for vpn clients only.