I'm no expert, but here's my 2 cents
AVG is a nice program. Buy it right from grisoft.com... in my experience i have seen not only the client side version find viruses symantec did not, but also in their exchange server version (server and exchange server are 2 different server versions)... obviously they share definitions so that should occur, but regardless it was nice to see. So, not only is it cheaper but (in my eyes) it has proven to be better then norton. Though i must admit, i hate symantec products. Their installation and overall functionality/integration/control over certain points of windows may be coded better now-a-days but they had already lost me by 1997 in regards to purchasing and actually using in production environments. I used F-Prot after norton, they actually offered 100% protection... wonder if they were ever sued by some infested user or company.... anyway, they are probably a good choice still and CA (Computer associated) seem to be whipping up some nifty programs, though i have never used or extensively read-up-on CA programs...
to get back onto avg... I would get the server version of AVG though, not the free client or "paid for" client version. They have a nice little network package too, centralized definition updates etc... heck, for any program, always get the server version if you're running a server and it is available. After all, WinXP Client isn't used to run your server right? There is usually a reason why there are multiple versions to programs and with a little research you can find out if there truly is a difference or if it's just a marketing ploy to charge more based on "server" label alone.
As for a firewall product, my opinion is to get something hardware... make your server's resources available to things like serving client requests, not things that can be done better elsewhere. I can only assume you are doing this to have a public IP on one of your NIC's, which is not the best idea (in my eyes) especially when you can have a good hardware firewall off ebay for $50 - 800. (no netgear, linksys or other soccer-mom products, even older sonicwalls can still stop most attacks...)