Even admin user who is by default allowed to see and modify fw groups from all projects can't attach fw group to the router's port which belongs to the other project then project owning fw group itself. It is like that because of the check https://github.com/openstack/neutron-fwaas/blob/master/neutron_fwaas/services/firewall/fwaas_plugin_v2.py#L167 which should probably be skipped if context.is_admin is True.