Yes, that is correct - the reason being is that all remote appliances and endpoint agents report back to the primary. This was an intentional choice because having one appliance analyzing telemetry, locally, provides an additional layer of security. Beyond this, it also saves us from connecting to, and continually pinging, all appliances and endpoints individually. This complexity and traffic may create stability or performance issues within your organization.  

We do, however, have a relay in place for every client that allows endpoint agents and remote appliances to connect to the appliance from other networks. This relay is also how Field Effect connects to the primary appliance. 

So, while an offline primary appliance is a critical situation, all endpoint agent and remote appliances will back up all data using the relay until the primary comes back online. At that point, the backlog of data will ingested and analyzed. 

To avoid these situations, we have developed a new deployment model that leverages a virtual primary appliance with remote sensors monitoring and sending traffic from the client site(s).