Keep the firewall on dedicated hardware. You don’t want your whole network going down because you have to do some work on the server.