Firewall and own modem

Depends on what you have.  If it's a gateway, set bridge mode (disables WAN, Disables Routing, Disables DHCP).  1st port on the gateway is the only one active usually.  That goes to the firewall.  Leave the exterior facing port on your firewall set to DHCP to get your public exterior IP address.  The gateway is just a pass through device to coax.  The interior port on your firewall handles your interior traffic with it's own DHCP server.  Create your port forward rules on the firewall.  That's the 'more normal' way to do it.

You can leave it as a 'double nat'.  Gateway still routes traffic on it's other ports (if used), passes out an inside address to your firewall, and your firewall creates another network inside that.  Now if you want to port forward, you have to create a rule on your gateway, and another rule on your firewall.  Benefit there is there are two firewalls, one on the gateway and one on the firewall.  Sort of a DMZ then on your gateway ports without being "wide open", but your firewall won't block anything there.  Inside firewall devices will see the gateway connected devices, but the broadcast traffic isn't going to route the other way and it's a bit messy and perhaps not very "Zen".  You'll get a lot of hits on port 1900 in your firewall logs unless you suppress that.....

If it's just a modem, it may have routing, or it may expect something else does it and it's just a pass through device.  You'll have to see if you have to set "bridge mode" on it or not in the manual.  Usually, they're pretty basic and limited on firmware options. 

Up to you, and you are the administrator of the network.