Every large, expandable (clustered) Filr deployment should have at least two Filr appliances for failover and splitting the workload.