lolo31
Enthusiast
Enthusiast

Isolation address in 2 Node Stretched Cluster

Jump to solution

Hello,

In a 2 Node Stretched Cluster :

Building1: ESX1

Building2: ESX2

Building3: Witness

Full L2 (No route / GW) for this VLAN that is used only for vSAN.

Dark Fiber 10Gb/s between Building 1 and 2.

I don't have any other device on this VLAN.

Is there any problem to use the Witness IP for the only isolation address ?

Thanks!

0 Kudos
1 Solution

Accepted Solutions
depping
Leadership
Leadership

the isolation address in this case can be the witness, as it is only a 2 node cluster that shouldn't be a problem. I do wonder how the witness is connected to the "data sites"... as full L2 including the witness network is not a scenario we recommend.

View solution in original post

0 Kudos
5 Replies
srodenburg
Expert
Expert

Well, a problem that I see is when you upgrade the witness-appliance. It' a rip-and-replace procedure. You delete the old appliance, build a new one by deploying a newer appliance-version etc. and all that time, both nodes are going bezerk because the witness is gone.

Don't forget that while the witness is unavailable, you cannot produce new objects. You can forget about making snapshots or powering on a VM etc. as all such actions produce new objects (snapshot-object, swap-object etc.)

And what if you simply reboot te witness. Not a problem as it's quite fast but both nodes will freak out.

Something tells me this is a bad idea... 😉

Read this:  Isolation Address in a 2-node direct connect vSAN environment? - Yellow Bricks

Or if the buildings are quite far apart and have their own physical uplinks to site 3, it's actually becoming a regular stretched cluster. Then this best practise applies: vSphere HA heartbeat datastores, the isolation address and vSAN - Yellow Bricks

0 Kudos
GreatWhiteTec
VMware Employee
VMware Employee

Please refer to StorageHub for recommendations on this setting.

https://storagehub.vmware.com/t/vmware-vsan/vsan-stretched-cluster-2-node-guide/cluster-settings-vsp...

A+, DCSE, MCP, MCSA, MCSE, MCTS, MCITP, MCDBA, NCDA, NCIE-SAN, NCIE-BR, VCP4, VCP5, VCP5-DT, VCAP5-DCA _____________________ If you find this or any other answer useful please consider awarding points by marking the answer correct or helpful.
0 Kudos
depping
Leadership
Leadership

the isolation address in this case can be the witness, as it is only a 2 node cluster that shouldn't be a problem. I do wonder how the witness is connected to the "data sites"... as full L2 including the witness network is not a scenario we recommend.

0 Kudos
lolo31
Enthusiast
Enthusiast

Hello,

Thanks you all for this informations.

depping

For the L2 network with the witness, I had no choice. (I know that L3 is recommended).

But you know, L2 is supported and the customer did not want to route his trafic to Witness...

With Witness for the isolation address, I tried a lot of failure scenario, and everything works as expected so i am going to keep it that way for now.

Regards.

0 Kudos
srodenburg
Expert
Expert

I still think there will be a problem when the witness appliance is, for example, upgraded.

During an upgrade, the appliance is removed from the FD config and the VM removed. From that moment on, both hosts will think they are isolated and start killing off VM's. There is no witness anymore to pick a winner either.

One can not hand-start VM's as it requires the witness appliance to be alive. But it's gone. So you end up stuck, until a new appliance is deployed and registered in the vSAN config of the cluster. Only then can you start VM's again.

It sounds like asking for trouble to be honest..

0 Kudos