Is this a common security rule or just a stupid one?
It is an extremely common policy, and arguably, due to the denial of service attack it implies, also a stupid one.
It's pretty standard in enterprises. You could argue it makes more sense here where there is a company helpdesk to cope with the fallout, and you would hope little motivation for another employee to be taking advantage of the DoS. In this context it is also required by some security standards, eg PCI DSS. In a consumer-facing context, where you have a greater range of potential attackers and higher costs in supporting locked-out users, it would be a worse trade-off.
The attack it is attempting to block is that of brute-force guessing a particular targeted user's account. If you want to get rid of account lockout you'd have to find some alternative mitigation for that attack. That might include:
harsher password complexity requirements: increasing the entropy in a password could greatly increase the number of guesses expected to get a breach;
two-factor authentication; potentially, using additional weak factors like IP addresses, device profiles and behaviour patterns to make a risk judgement and potentially prompt for a second factor or an additional authenticator;
rate-limiting based on IP/reputation, to slow down access to the login interface progressively when there are many recent failed logins.
Because the account lockout mechanism does not attempt to guard against the scenario of brute-force guessing across many accounts (eg, the ‘inverted password guessing’ attack of picking a common password and trying it across many accounts), you may well want to consider some of these approaches in any case. (The other traditional mitigation against this kind of attack is to keep the usernames semi-secret, protecting against username enumeration, but this is a bit weak and can be hard to cover completely for some kinds of system.)
I'm not sure what might be appropriate in your particular situation but since you mention a ‘mainframe’ my suspicion would be a legacy system with little scope for change. It's also not clear what kind of ‘firewall’ would be concerned with user passwords—are you talking about web proxy authentication?