How to configure Firepower FTD to fail to a secure state?

[CiscoPurpleBelt]

Upon system reboot, initialization, abort, etc., how can you confirm the Firepower (FTD software) fails to a secure state and if you must configure, how do you do it and/or what is the syntex?

[Tariq Mahmoud]

Can you elaborate further on what you mean by "secure state", or state your requirements? 

You can refer to the advisory lists below to check further if any FTD software is affected by any vulnerability  :
https://sec.cloudapps.cisco.com/security/center/publicationListing.x
If there is a bug, you should patch, upgrade, or implement it's workaround. Beside that I believe the normal configuration should be okay.

[CiscoPurpleBelt]

The FTD will stop forwarding traffic if any of those events occur.

[MHM Cisco World]

SecureInLife: First step in Firepower Threat Defense

I think you talk about if SNORT is failed what FTD will do? it can open or closed
check link above 

[CiscoPurpleBelt]

No I believe it is just in general what the FTD will do. Also, Im using FMC and there are no inline set configured or entries under the FTD.

[Marvin Rhoads · Accepted solution]

From this and several other questions you've posed it sounds like you are trying to document DISA STIG compliance.

I don't believe that FTD is compliant with this particular requirement, so you may need to use a compensating control.

[CiscoPurpleBelt]

Compensating control meaning an alternate config on the FTD?

[Marvin Rhoads · Accepted solution]

Not an alternate configuration - I was thinking more of an operational procedure to ensure the desired result. That is, doing something outside of the firewall to ensure continued system protection is in place, even it it means "fail close" - for example, disconnecting the interfaces until the configuration is verified good following a system failure. Either that or accept the risk of not meeting that particular requirement.

[CiscoPurpleBelt]

Ok right. Thanks!