The firewall is not getting enabled on the agents as they are pending a reboot. However, checking Agent Management in the OSCE management console, Restart Required shows "No".
This is currently the SPEC. The reason why the the firewall is not updated is because of the setting below:
Global Agent Settings > Firewall Settings:
'Update the OfficeScan firewall driver only after a system restart'
One option is to disable the setting above, but please note that this can cause a slight disconnection from the network. Do not do this in critical environments.