We don't have a firewall protecting any of our servers. Here's why:
Host-based security says that any open port is a potential vulnerability (including, but not limited to, the ports you're intentionally making available to the public). If your servers simply do not have any open ports but the ones that you want to make available to the public, that's almost the same protection as a firewall will give you. The only added benefit that a firewall will bring is that you can easily control which IP addresses on the internet are (or are not) allowed to access the otherwise publicly-available ports. However, many servers have this functionality built in anyway. One other benefit is that a hardware firewall can be configured to use only one public IP address for many machines - which is mostly what they're used for these days.
Also, if there are ports open and servers running that you don't want to make publicly available because you know they're vulnerable somehow (and thus, need the protection of a separate firewall), security doctrine says that's little protection against attackers, because there's several ways to circumvent the firewall anyway. Say you have an SSH or HTTP server behind a firewall, and several vulnerable windows machines on the same network. Should someone break into the server, they have access to the entire internal network. Likewise, should someone download a virus, that computer could attack your server from inside the network.
You're better off using the firewall software on the server and not bothering with the "hardware" firewall. That is, if you even need a firewall to begin with. Secure your web server such that the only software it's running is IIS, and only IIS will be vulnerable to attack. Which would be true whether you have a firewall or not.
Edited to add:
I also originally wanted to point out that a hardware firewall also adds a single point of failure to the network. This issue is also one of the major reasons we don't have a firewall protecting our servers. While it centralizes administration, it also centralizes outages caused by administration. It's also worth noting that all the servers run Debian, and vulnerabilities in the kernel and libraries are patched in a reasonable amount of time.
While hardware firewalls ensure that the holes don't line up, attackers are mostly interested in where the holes do line up: like in the ports that are specifically open in the firewall. If there's a vulnerability in a service that you provide, that is where they will attack. And get through your firewall(s). And attack the rest of the network, looking for the easier vulnerabilities that the firewall was supposedly protecting.
FYI, we haven't had any servers exploited since switching to Debian and using the Debsecan software, save for a few webmail accounts that fell victim to phishing attacks.