A few questions to understand your environment better:
1) Are you replacing the primary or secondary KS?
2) Are all your GM's registered to the primary or are they split up based on location? Do they all have access to the both GM's?
The reason I ask the above is that in a GETVPN environment, the primary KS always sends the rekey even though a GM registers to the secondary. So if the primary loses communication to secondary but still has access to the GM's, this could cause both (since secondary now assumes primary role) to send rekey causing outages.
If you are removing primary, then I would recommend you take it off the network completely immediately after a rekey (usually happens every 2 hours). Add the new KS to the network - with same RSA key and lower priority. This will ensure that the new KS will first take over as new secondary. Once this is done and everything is stable, remove old secondary from network and let the new router send one rekey if possible. If verified, then add the old secondary back as secondary with lower priority than new KS. During all this, connectivity between all KS and GM's are required for complete functionality.
If it is secondary you are removing, the process should be the same, just no requirement to change priorities when adding the new secondary KS (only same RSA key). Again connectivity is essential for this to function.
Hope this helps.
