SFR policy map

[royboymlm]

what is the difference between fail open, and fail close for the SFR?

[Pujita Patni · Accepted solution]

Hi,

• The fail-close keyword sets the ASA to block all traffic if the ASA FirePOWER module is unavailable.
• The fail-open keyword sets the ASA to allow all traffic through, uninspected, if the module is unavailable.

Here is the documentation for the same:

http://www.cisco.com/c/en/us/td/docs/security/asa/asa93/configuration/firewall/asa-firewall-cli/modules-sfr.html#17048

Thanks,

Pujita

Rate if it helps !