Requests that are initializing GSS security contexts cannot be resent to failover NIDs, as they contain information specific to the remote peer NID. If they are resent to a different NID, GSS will reject them anyway.