ASM deployment architecture

I would recommend talking directly to F5 sales, but to my knowledge the ASM cannot run in a sniffer mode, and does not offer a fail open option. It is an active participant in the conversation, so the options you are asking about really aren't applicable. The options you are describing are more in-line with an IDS/IPS type solution. The ASM is more like an L7 firewall. Imagine running your primary firewall as fail open or on a sniffer port, the same applies here, it just doesn't work like that.