on a system with fail2ban installed and activated it is impossible to use
systemctl restart to restart firewalld:

nextcloud:~ # systemctl restart firewalld
Failed to restart firewalld.service: Transaction contains conflicting jobs
'restart' and 'stop' for fail2ban.service. Probably contradicting requirement
dependencies configured.
See system logs and 'systemctl status firewalld.service' for details.

the sequence "systemctl stop fail2ban; systemctl restart firewalld; systemctl
start fail2ban" works as exected.

the same used to happen when I still used SuSEfirewall2 instead of firewalld,
so I'm pretty sure the issue is with fail2ban and not with either of the two
firewalls...

for more info:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=871993
https://bugzilla.redhat.com/show_bug.cgi?id=1379141
https://lists.freedesktop.org/archives/systemd-devel/2016-March/036011.html