https://community.cisco.com/t5/network-security/sfr-policy-map/m-p/2905028#M1030096 <P>Hi,</P> <P></P> <UL> <LI class="pSBu1_StepBullet1">The<B class="cBold"> fail-close</B> keyword sets the ASA to block all traffic if the ASA FirePOWER module is unavailable.</LI> <LI class="pSBu1_StepBullet1">The <B class="cBold">fail-open</B> keyword sets the ASA to allow all traffic through, uninspected, if the module is unavailable.</LI> </UL> <P></P> <P>Here is the documentation for the same:</P> <P>http://www.cisco.com/c/en/us/td/docs/security/asa/asa93/configuration/firewall/asa-firewall-cli/modules-sfr.html#17048</P> <P></P> <P>Thanks,</P> <P>Pujita</P> <P>Rate if it helps !</P> Thu, 07 Jul 2016 22:51:49 GMT Pujita Patni 2016-07-07T22:51:49Z https://community.cisco.com/t5/network-security/sfr-policy-map/m-p/2905027#M1030092 <P>what is the difference between fail open, and fail close for the SFR?</P> Tue, 12 Mar 2019 13:04:00 GMT https://community.cisco.com/t5/network-security/sfr-policy-map/m-p/2905027#M1030092 royboymlm 2019-03-12T13:04:00Z https://community.cisco.com/t5/network-security/sfr-policy-map/m-p/2905028#M1030096 <P>Hi,</P> <P></P> <UL> <LI class="pSBu1_StepBullet1">The<B class="cBold"> fail-close</B> keyword sets the ASA to block all traffic if the ASA FirePOWER module is unavailable.</LI> <LI class="pSBu1_StepBullet1">The <B class="cBold">fail-open</B> keyword sets the ASA to allow all traffic through, uninspected, if the module is unavailable.</LI> </UL> <P></P> <P>Here is the documentation for the same:</P> <P>http://www.cisco.com/c/en/us/td/docs/security/asa/asa93/configuration/firewall/asa-firewall-cli/modules-sfr.html#17048</P> <P></P> <P>Thanks,</P> <P>Pujita</P> <P>Rate if it helps !</P> Thu, 07 Jul 2016 22:51:49 GMT https://community.cisco.com/t5/network-security/sfr-policy-map/m-p/2905028#M1030096 Pujita Patni 2016-07-07T22:51:49Z