The stretched cluster model spreads one vSphere cluster over two availability zones with synchronous storage, so a whole zone can fail while vSphere HA restarts its VMs in the other.
Prerequisites and limits:
- At most two availability zones per stretched cluster; with vSAN, a third independent fault domain hosts the vSAN witness appliance.
- vSAN stretched clusters need at least 10 Gbps and under 5 ms round-trip time between the data sites; the VCF design requirement puts the witness under 150 ms away (vSAN itself allows up to 200 ms RTT with up to 10 hosts per site, and 100 ms with 11 to 15), with bandwidth sized from the number of protected components. Array-based stretched storage takes its figures from the storage vendor.
- The management domain must be stretched before any workload domain cluster can be, so the components that manage the workload domains survive a zone loss.
- Each zone can be a single rack or a Layer 2 multi-rack cluster; Layer 3 multi-rack clusters cannot be stretched, and the cluster models page also says a single-rack storage cluster using vSAN storage cluster client traffic separation cannot be stretched.
| Cluster | vSAN hosts | NFS or FC hosts |
|---|---|---|
| Management first cluster, simple | 6 | 2 minimum, 4 recommended |
| Management first cluster, HA | 8 | 6 minimum, 8 recommended |
| Other clusters | 6 | 2 minimum, 4 recommended |
Both zones must hold the same number of hosts, so expansion happens in pairs. With three vSAN hosts per site, a local host failure is tolerated but its objects are not rebuilt automatically.
Capacity and placement:
- Admission control reserves 50% of the cluster: in an eight-host stretched cluster, four hosts’ worth of resources are usable.
- Host groups per zone, VM groups per zone and should-run VM/Host rules keep VMs in their assigned zone and avoid needless vMotion; the NSX Manager appliances join the first zone’s VM group. Placement rules should match the vSAN policies so storage locality and failover response agree.
- VCF places management components in the first zone, so the management cluster runs active/standby; workload clusters can run active/active or active/standby.
- On vSAN OSA, the default policy uses site mirroring plus one failure tolerated with RAID-1; on vSAN ESA, auto-policy management adjusts the default policy when the cluster is stretched. Force provisioning lets objects be created while one zone is down. Reserved capacity is not supported on stretched clusters.
- Disable HA datastore heartbeating. DRS awareness of vSAN stretched clusters keeps recovered VMs in the surviving zone until their data has resynchronised, then moves them back automatically.
Networks. The VM management network is stretched at Layer 2 with a gateway that is highly available across zones. Host management, vMotion, vSAN and host overlay networks are per zone (VCF workflows need two routable vSAN VLANs), each with a highly available Layer 3 gateway. Each vSAN VMkernel adapter overrides the default gateway so vSAN traffic routes through the vSAN gateway. NSX needs an uplink profile and TEP pool per zone and a sub-transport node profile for the second zone. Layer 3 routing between the data sites and the witness is recommended, with witness traffic separation over the witness’s management interface (vmk0) at the management MTU.
Witness. Place the witness appliance in a third site with no logical or physical dependency on either zone, matching the vSAN architecture (ESA or OSA) and managed with vSphere Lifecycle Manager images. One witness serves one stretched cluster; do not snapshot or back it up. Figure 8.1 shows the two zones, the witness site and the limits on each link.
Failure behaviour. If a site fails, vSAN keeps serving from the other site and vSphere HA restarts the VMs. If the inter-site link fails, the preferred site carries on. If the witness fails, objects become non-compliant but stay accessible.
| Requirement or driver | Design decision | Justification | Implication |
|---|---|---|---|
| Survive loss of a whole zone | Stretched cluster model | Synchronous copy per zone | Half the capacity reserved |
| Workload domain must be stretched | Stretch management domain first | Prerequisite | Eight hosts for HA management |
| Witness must survive zone loss | Witness in a third site | Independent tiebreaker | Third location, under 150 ms |
| Zones in separate buildings | Verify 10 Gbps and 5 ms RTT | vSAN stretched limits | Limits distance |
| Keep VMs local to a zone | Host and VM groups, should rules | Avoid cross-zone traffic | Manual group membership |
Common trap: Keeping the single-host admission control reserve after stretching a cluster - a zone failure removes half the hosts, so the VCF design recommends raising the reserve to 50% of the cluster; anything less means some VMs cannot restart.
Common trap: Hosting the vSAN witness in one of the two data zones - the witness must sit in a third location independent of both; otherwise losing that zone also loses the tiebreaker.