In case anyone needs this, I found that this (quite batchable) command opens the XPSP2 Firewall appropriately so Symantec Management Console can push SAV licenses to workstations:
> netsh firewall set portopening TCP 2967 "Symantec AntiVirus Client Management" enable subnet