Now that I've had more time to troubleshoot, here is scenario:
Server1 - 2008 OS - FW service enabled - FW profile disabled - SEP 11.0.6300. Once upgrade to SEP 12.1 RU1, FW profile became enabled blocking traffic. Turning off profile fixed issue
Server2 - 2008 OS - FW service enabled - FW profile disabled. SEP 11.0.6200. Once upgraded to SEP 12.1 RU1, FW profile became enabled blocking traffic. Turning off profile fixed issue.
Server3 - 2008 OS - FW service enabled - FW profile disabled. SEP 11.0.4000. Once upgraded to SEP 12.1 RU1, no issues occurred.
So upgrade to 12.1 RU1 enabled fw profiles causing traffic to be blocked on two machines.
Only AV component installed. Never had NTP on these machines.