The firewall group is ACTIVE without associcate with a router or any firewall policies.

[dongdong]

The firewall group should be in an INACTIVE state when not associated with a router and firewall policies, but there may be instances where it is in an ACTIVE state.
# openstack firewall group show 04bae29d-aad5-4e1d-8685-083a1592a79a
+-------------------+--------------------------------------+
| Field | Value |
+-------------------+--------------------------------------+
| Description | |
| Egress Policy ID | None |
| ID | 04bae29d-aad5-4e1d-8685-083a1592a79a |
| Ingress Policy ID | None |
| Name | ddd2 |
| Ports | [] |
| Project | f16038aec2be4af39242cb8739a29039 |
| Shared | False |
| State | UP |
| Status | ACTIVE |
| project_id | f16038aec2be4af39242cb8739a29039 |
+-------------------+--------------------------------------+

Recurrence process：
1. Create firewall group;
2. Associate with a router;
3. Update the router;
4. Check the firewall status is already ACTIVE;
5. Disassociate from the router, and the firewall status remains ACTIVE.

Version:
OpenStack: Zed
OS: CentOS 9 stream

[OpenStack Infra (hudson-openstack)]

Related fix proposed to branch: master
Review: https://review.opendev.org/c/openstack/neutron-fwaas/+/904317