vSAN Witness partition issues on new VCF 9.1 deployment

Products

• VMware vSAN

Issue/Introduction

In VMware Cloud Foundation (VCF) 9.1 greenfield deployments, a vSAN Stretched Cluster may report a witness partition alarm in vSAN Skyline Health. This issue occurs when data node interfaces are incorrectly configured with a trafficTypeMask that includes both data and witness traffic. This configuration misroutes vSAN heartbeats through the management interface instead of the designated vSAN interface.

• vSAN Skyline Health reports "Witness host is partitioned."
• vSAN objects report as having reduced availability.
• Data nodes advertise witness traffic on the incorrect VMkernel interface.
• cmmds-tool shows the interface mask for the vSAN interface is not set to 1 (vsan).

Environment

VMware Cloud Foundation 9.1

VMware vSAN 9.1

Cause

The trafficTypeMask is incorrectly applied to the data node vSAN interface during initial VCF 9.1 deployment. The data interface retains the witness tag, causing heartbeat traffic to route to the management network rather than the vSAN network.

Resolution

1. Log in to the ESXi host via SSH.
2. Remove the existing vSAN interface configuration for the impacted interface: esxcli vsan network ip remove -i vmk#
3. Re-add the interface with the correct tagging for vSAN traffic: esxcli vsan network ip add -i vmk# -T vsan
4. Repeat these steps for all data hosts in the cluster, one host at a time.
5. Validate the configuration by running the following command: esxcli vsan network list
6. Confirm the mask configuration by running: cmmds-tool find --type NET_INTERFACE The mask for the vSAN interface should update to 1 (vsan), and the management interface should reflect the witness mask 2.
7. Verify the witness host re-joins the cluster and partition alarms clear in vSAN Skyline Health.