Unavailability of vSAN resources after reconfiguring HA( vSAN network alarm 'vSAN cluster partition')

Products

• VMware vSAN
• VMware vCenter Server

Issue/Introduction

After reconfiguring HA on a vSAN enabled cluster, the cluster goes in to a network partition state. 

You also observe SSL issues such as the following when you attempt to place the isolated host in to Maintenance Mode or vCenter is reporting it can not synchronize with the host as it "Cannot verify the ssl thumbprint" 

A general system error occurred: SSL Exception: Verification parameters:
PeerThumbprint:  ##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##
ExpectedThumbprint: ##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##
ExpectedPeerName: localhost.localdomain
The remote host certificate has these problems:

Environment

vCenter server (All Versions)

VMware vSAN (All Versions)

Cause

The SSL issue will prevent vCenter from synchronizing with the host correctly and will have a direct impact on several advanced vCenter features that rely on proper communication between the ESXi host and vCenter. These features will be impacted when synchronization is lost.  As vCenter Server acts as the central management point for the entire vSAN cluster, when the reconfiguring HA task was run a parallel vSAN configuration task will be run as well.  Among other operations the "Update vSAN Configuration" task will update each host in the cluster with the current unicast agent list. As vCenter was not synchronized with all hosts in the cluster when this update task is run, the unicast agent list will be updated with the information from all hosts that are  currently synchronized with vCenter.  This means that the host that is not synchronized unicast entry will be missing form this update causing the 'vSAN cluster partition' error. 

Resolution

Verify you have a SSL issue by reviewing the following KB article. 

Custom certificate on an ESXi host is not accepted by the vCenter Server. Error: A general system error occurred: SSL Exception: Verification Parameters: PeerThumbprint 

After SSL issue has been confirmed, reboot the ESXi host to clear the cached state of the vpxa service, then reconnect the host to vCenter.  When you reconnect the host to vCenter it will kick off another "Update vSAN Configuration" operation that will correct the unicast agent lists and the the 'vSAN cluster partition' error should be corrected. 

If you have any questions or issues on this action, please open a case with VMware Support for further investigation.