Configuring PIX Firewall

there are a lot configuration examples you would find in web (e.g. http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a0080094768.shtml) but since you have already working infrastructure adding new firewall would result in changing your ip addressing scheme. i would recommend instead of pix to buy asa which is successor of the pix family and do transparent firewall. the firewall in this mode is like bump on the wire works as L2 device, which you can connect between your isa and isp router without renumbering and changing already existing L3 settings.

otherwise you need to:

1. if needed extend and divide your external ip range from your ISP in 2 subnes. leave the external ip address of the ISA (spending you whole bunch reconfiguration work) and connect it with the PIX. this makes your inside from pix prospective.
ISP ---(new.subnet)---PIX---- (old.subnet)----ISA

2. on asa configure default gateway being the inside ip of the PIX

3. configure default route on the PIX, next hop your ISP router

4. configure nat exeption rule on your inside. your ISA remains in charge  for nat:
nat (inside) 0 0.0.0.0 0.0.0.0

5. configure ACLs permitting whatever kind of traffic you allows inbound on your pix's outside interface. e.g. SMTP
access-list acl-outside permit tcp any host <ISA's ip address> eq 25
access-group acl-outside in interface outside

6. configure static nat translation to your ISA server. (PIX doesn't route if there is no xlate translation slot)
static (inside,outside) tcp interface 25 <ISA's ip address> netmask 255.255.255.255

7. do your tests if the whole thing works as suppose to.