Network & Infrastructure / High Availability & Recovery Design
Witness placement and correlated site failure
A two-site design loses its witness whenever the preferred site fails, leaving the surviving site unable to obtain the expected decision authority. The witness shared the same physical dependency.
Environment and inputs: Routed and clustered services; define failure ownership, fencing and application recovery requirements before testing. Diagnostic/design example; not tested on production equipment.
Collect the evidence
Map witness power, network routes, DNS, identity and hosting dependencies to the sites it arbitrates. Include maintenance and firewall paths as well as geographic location.
Explain the result
A witness adds useful independence only when its dependencies are sufficiently separate for the intended failure model. A different VM name or VLAN does not establish an independent site.
Plan the fix
Choose a supported witness location and connectivity model from the actual partition scenarios. Document which side should continue for each loss and avoid circular dependence on the service being protected.
Check the result and rollback
Exercise site, witness and intersite-link failures separately in isolation. Revert if the new placement permits ambiguous ownership or cannot communicate under the very failure it is intended to arbitrate.