You need newer versions of software to support 2K3. Most of them will work.
How exactly are you setting this up? Sounds like you want it to be a firewall it's self, AND a web server to the outside. That's not a good setup.
Generally you want to use a DMZ (Demilitarized zone) setup. You have one firewall, the external one, that filters connections from the outside to the inside. And it connects to any servers that can be accessed from the internet, such as a web server. Then you have a SECOND firewall that protects your interanet from the DMZ network. This way, if the exposed servers become compromised, then you protect your internal network. Placing the firewall *ON* the web server isn't a good idea, because a web server is a way into the network. If it becomes compromised via the web server, then the firewall can not stop it. Indeed, the firewall is now under the attackers control. If you just had one firewall, the web server, and it was compromised, then they have a direct connection to your whole network. That's why any firewall that protects your whole network should be just that, a firewall, and nothing else. Have as little of an attack surface as you can.
In general, a good way to think, protect the networks from attacks from the internet, protect your clients from attacks from each other. Windows built-in firewall, Zone Alarm, and all these others are labeled as client firewalls, and that’s what they should do. Protect clients from internal threats, such as viruses spreading inside the network. Use a dedicated firewall to protect the whole network then.
