On the Symantec Endpoint Security (SES) console "Allow the following users to enable and disable the firewall" setting is enabled in Firewall Policy under Client User Control Settings and if the end-user disables the firewall on macOS it does not re-enable again.
SEP for MAC
The firewall-re-enable feature is not supported on the SEP for Mac agent
It is an expected behavior because the feature is not supported on the MAC
If the end-user disabled the SEP firewall it re-enables in five minutes for Windows agents.