What I do, and is recommended practice, is to not remove the existing firewall and AV until your intended replacements have been downloaded ready to install. (And any uninstall tools that may be needed.)
Alternatively, use another computer and place the required installer files on a flash drive.
Either way, you can install your security without being online.
I have done this the naive way before, a handful of times (long long ago, on a PC far away) and have on some of those occasions become infected, and needed an online scanner to fix things up. At the time I used TrendMicro Housecall.
After getting the new computer with Symantec pre-installed, I got semi-wise, and worked out how to do it safely. (I didn't know about uninstall/removal tools then. Took me a long time to completely remove the Symantec stuff.)