This is how I do upgrade for HA from 2.3 to 2.5.
I disconnect Master from network (or change IP for Network interface) to prevent APs from prematurely download of new firmware after upgrade - because if APs seen Master with new firmware, they immediately download new firmware, that will not work with old Node.
Next, I upgrade primary unit, check Alarms, upload new firmware.
If upgrade for Master done well you should disable HA on Master and set it as Standalone, cause if you upgrade it to a newest version, Mster will send new configuration snapshot to Node, and it will kill Node with old firmware.
When upgrade for primary vWLAN done and all alarms ang configurations checked, you may connect it to the network - APs shortly recognize that main vWLAN is up and start downloading new firmware and upgrading process. After this step, HA will not work for APs - in case of failure on main vWLAN, APs will NOT fall back to Node vWLAN. If you recognize any major failure on this step - you can switch back to previous version by rebooting primary vWLAN to older version, after that HA will be restored. I loose only one AP from 400 (1800 series) when do upgrade.
If upgrade on primary vWLAN goes well, you can proceed on slave, after sucessfull upgrade on slave - turn on HA on primary unit.