From the doc http://www.vmware.com/pdf/vshield_50_admin.pdf page 11:
Migration of vShield Components
The vShield Manager and vShield Edge virtual appliances can be automatically or manually migrated based
on DRS and HA policies. The vShield Manager must always be up, so you must migrate the vShield Manager
whenever the current ESX host undergoes a reboot or maintenance mode routine.
Each vShield Edge should move with its secured port group to maintain security settings and services.
vShield App, vShield Endpoint, or vShield Data Security cannot be moved to another ESX host. If the ESX host
on which these components reside requires a manual maintenance mode operation, you must de-select the
Move powered off and suspended virtual machines to other hosts in the cluster check box to ensure these
virtual appliances are not migrated. These services restart after the ESX host comes online.