how have you defined the failed login rule?
since the URL variable name you are using is "failed":
go to the bindings panel, click the plus button and select URL Variable, name it "failed"
In the access rule manager, edit the failed login rule.
Select the Allow radio button
click the lightning bolt icon next to Value and select the "failed" URL Variable binding.
Set the criteria to "<>" this means Not Equal
Leave the compare to field blank