No, something's fucked up here. The firewall options are greyed out for services that arent reporting daemon status.
BTW, the best way to manage say the ssh service on ESXi hosts is to set it to automatic, controlling access via the network or esxi's firewall access lists gui. BUT, if the firewall can't stat the daemon, IT DOES NOT WORK FOR SAID DAEMON....which is chappin my ass right now