You can replace a member of an HA pair with another Network Security appliance. After you replace a member of the pair:
New alerts the replaced appliance generates are applied to the individual appliance. Alerts the replaced appliance generated while it was part of the pair remain associated with the pair.
New alerts the replacement appliance generates are applied to the pair. Alerts the replacement appliance generated before it was part of the pair remain associated with it as an individual appliance.
For information about how the Central Management System appliance handles alert aggregation in related scenarios, see Alert aggregation. If you are replacing a defective appliance, see Recovering malware-object events after a failure using the CLI and Replacing an HA member using an RMA.
Prerequisites
Operator or Admin access