Security

There are no tricks with Firewall-1, or any other software firewalls. The first step to install Firewall-1 is to secure the underlying operating system. The procedure is available from the Check Point's website. The default installation of the FW-1 has no ports open, or access enabled. You'll need to open them up as needed. The AV server can be installed on the same server, depending on the traffic what it'll handle. For a small to mid-size LAN it should be OK.
If this is your first encounter with the FW-1, then I'd suggest to let the contractor install it. That would ensure it's set up properly and you'll have a "free" training during the process.

Otto

I wouldn't put anything on the firewall box. You need the firewall to be ultra reliable and secure. Pay the money and get a professional to install the firewall for you. If they mess it up, you have someone to sue for damages.

Firewall-1 will cost you roughly $10k no matter what. You can't get out of it. Be aware though, that's it's worth the money. Don't attempt to set it up by yourself though, just pay attention to the consultant. I do NOT recommend that you installthe AV software on the Firewall server. I recommend investing in a separate BDC server to run such applicatons on. This will help in traffic and processing on both servers. You can also run many other applications off of your AV application server. Although you may be able to get away with Firewall and AV on one server, it will all depend on many characteristics of your network. Good luck.