IPSec clients work on the IP layer. The authentication occurs via IKE. It can best be done using digital certificates. When the client is started it gets authenticated on the VPN gateway to which it is connecting.
Suppose that the 3015 sits on the dmz interface of the PIX with the subnet 10.1.1.0/24 confgured on it. Now, if you use a range of addresses from this subnet to assign addresses to the VPN clients, the PIX will know that this subnet exists on its DMZ...
Both have their advantages. Depending on what platform you have for the router, the PIX may or may not be the faster box. Please look at the following doc for PIX performance figures:http://www.cisco.com/warp/public/cc/pd/fw/sqfw500/prodlit/cspix_dg....
