I was at PuppetConf last week and, from an automation perspective (and ease of overall management), the majority of people that I spoke with turn off firewalld in favor of iptables.
In particular, anyone that was compliance focused was 100% against any application being able to modify the firewall directly with the notable exceptions of Docker and OpenStack.
Finally, I have enough trouble getting people to understand the output of a linear iptables output. I gave up trying to explain the firewalld output.
Prior to sticking it in the STIG, *please* see if a stock-standard ISSO can understand both the ramifications and the output of using firewalld in production.
If we are to stick with firewalld, I might suggest that the default rules be replaced with two zones, trusted and untrusted as this makes things MUCH easier.
To Jeff's original point, there is now the 'direct' command in firewall-cmd that lets you just shove iptables rules into the stack. I haven't played with this enough to determine if it makes any sense to use in production. I will say that trying to read the output of a raw iptables command once firewalld is running is pretty much impossible on a standard terminal. Likewise, running 15 commands to try and figure out what's actually going on with the firewalld stack is highly irritating.
Heck, I had to resort to writing down the entire stack on paper because I couldn't just read it!
Yours Curmudgeonly,