It's a bug that was fixed in RU4 so you can upgrade to RU4 to correct it.
See fix here:
Client reports Firewall Status as “Disabled”
Fix ID: 3115966
Symptom: If you disable or withdraw the firewall policy from a client group, the clients display as “Disabled” on the Symantec Endpoint Protection Manager Home tab, under Endpoint Status. Clicking on the Endpoint Status chart shows the Firewall Status as “Disabled.” The Firewall Status should only display as “Disabled” if the end user disables the firewall.
Solution: Implemented the creation of a registry key during a clean installation, kept during migration, to correctly trigger the “Disabled” firewall status report.
New fixes and features in Symantec Endpoint Protection 12.1.4