Hi .. If I understood correctly. You want to be able to reach to a Public range which will locate behind the PIX 's inside interface. Those IPs will hit an F5 balancer ( whatever that is) and then it will either NAT internally or load balance traffic ..? Did I get the picture right ..?
If this is the case, then the only thing you need is to replicate the configuration from the Checkpoint to the PIX in regards to IP addresses and static routes. Of course PIX is different interface but the same principle applies to any firewall. Yes you can route without using NAT. Once the packets reaches the F5 load balancer then the PIX's job is done. Everything else is up to the way that F5 device has been configured.
Below a brief draft ..
1.- Configure failover between the PIXes. PLease refer to the Cisco Documentation depending of the code yu are running.
1.- Configure IP addresses and static routes as per the Checkpoint. For PIX you will use security 0 for the Outside interface and security 100 for the Inside Interface.
2.- Check Internet connectivity between your PIX's outside interface and the ISP router.
3.- For access from Internet to Public range behind the PIX. You need to open the ports you want by using an access-list and apply it to the Outside interface of the PIX .i..e
access-list Outside-In extended permit tcp any x.x.x.x 255.255.255.0 eq www
.
.
.
acccess-group Outside-In in interface outside
this will allow any Inbound traffic to x.x.x.x (your Public network behind the PIX)
4.- For access To the internet from behind the firewall you need to bypass NAT and use an access-list to control outbound traffic ..i.e
access-list nonat extended permit ip x.x.x.x 255.255.255.0 any
nat (inside) 0 access-list nonat
access-list Inside-Out extended permit ip x.x.x.x 255.255.255.0 any
access-group Inside-Out in interface inside
Of course you can lock this down as you need.
This should be all you need to do.
I hope it helps .. please rate it if it does !!!
