When adding a distributed firewall rule to a universal section, if the rule is applied to a specific Security Group, the Publish operation will provide an error message:
Publishing firewall rule fails.
The publish operation does succeed, but the NSX Manager is unable to update the status of the firewall due to transaction timing issue.
This issue is resolved in VMware NSX for vSphere 6.4.0.
Workaround:
Clear this message from the GUI is to resync the NSX prepped clusters that use the Distributed Firewall.
To resync the Firewall on at the cluster level from NSX, navigate to:
Network and Security > Installation > Host Preparation > Select a Cluster > Actions > Force Sync Services > Check the "Firewall" box > click OK.