Symantec Endpoint Protection (SEP) for Mac displays "Enabled" firewall status at SEPM despite withdrawn or disabled policy.
As of SEP 14.3.1148 (14.3 MP1), SEP for Mac would display "Disabled by policy" for firewall status at SEPM if policy were withdrawn or disabled. SEP 14.3 RU1 displays "Enabled".
Symantec is aware of the issue and this document will be updated as new information becomes available. You may verify that the firewall is disabled by checking the toggle status in client GUI.