vSAN with vSphere High Availability advanced settings required for use with physically or logically segregated networks

Products

• VMware vSAN

Issue/Introduction

Scope:

In Networking Configurations where the vSAN and management networks are on a different physical or logical network and traffic is segregated, it is required to change the default vSphere HA isolation address from the management network to the vSAN network.



Background:
- In a vSAN cluster, vSphere HA agents communicate over the vSAN network.
This is so that in the event of a network failure, vSphere HA and vSAN are on the same network.
This is turn avoids conflicts when vSphere HA and vSAN experience different partitions when failures occur.
- vSAN always needs to be configured before HA is enabled.
- vSphere HA in vSAN uses hosts management network default gateway IP for isolation detection when configured with default settings.
- never use a vmkernel interface IP for HA isolation address

Resolution

Vmware's requires Administrators to set two specific advanced configuration settings in the vSphere HA configuration when
there is segregation between Management network and vSAN network.


We recommend use of a active IP address on the vSAN network as an "isolation address".


das.usedefaultisolationaddress=false
das.isolationaddress0=<IP address on vSAN network>


In some situations there may not be a suitable isolation address on the vsan network. In this case most physical top of rack switches can configure a port for SVI switch virtual interface to be used as the isolation address.

Additional Information

Using vSAN and vSphere HA
https://docs.vmware.com/en/VMware-vSphere/7.0/com.vmware.vsphere.vsan-planning.doc/GUID-D68890D8-841A-4BD1-ACA1-DA3D25B6A37A.html

vSphere High Availability (HA) fails to restart a virtual machine when VMware vSAN network is partitioned
https://kb.vmware.com/s/article/2073949