In HA deployments, the Advanced IP Defense local cache does not synchronize between HA peers. After a failover, the newly active enforcement point starts with a cold cache and queries the Advanced IP Defense cloud service for all IP attribute lookups until the cache is repopulated. During this period, cache-miss behavior (default: skip to next rule) applies to all sessions until the cloud returns verdicts.

Direct-to-IP detection requires network and DNS traffic to traverse the same network firewall. Direct-to-IP detection is not supported on Active-Active HA deployments where DNS and network traffic is split between two firewalls.