downgrade to Snort v2 on FTD HA pair

[securityengineering]

We have several FTD HA pairs. One set has a single FTD running Snort 3. And one set has both FTDs running Snort 3. We've decided to downgrade all FTDs to Snort 2. Is it possible/advisable to downgrade a single FTD to Snort 2 while leaving the other member at Snort 3? Then the following night we would downgrade the 2nd member to Snort 2. 

The goal is to downgrade as safely as possible, not as quickly as possible. 

[Marvin Rhoads · Accepted solution]

You should downgrade both members of a given HA pair. That will give the most deterministic behavior and avoid possible edge cases where traffic could be treated differently depending on which member is Active.