Hi,
I’m looking for clarification on AHV Metro Availability behavior and the supported procedure for temporarily isolating an entire site during network maintenance (switching replacement).
The environment consists of two Nutanix AHV clusters with synchronous replication, managed through Prism Centrals (one per site) and a Witness VM deployed at a third site over a VPN. As aditional info AOS and PC versions are PC/AOS 7.6 and AHV 11.0.2 .
The customer reported the following sequence during a switch replacement:
-
They disconnected the VPN to the witness, intending to make it unreachable from both clusters (that should avoid automatic launch of any recovery plan).
-
Then they disconnected one swich on cluster A, so cluster B was unable to reach it.
-
According to the customer, at that moment recovery automatically started and the VMs from cluster A were recovered on the cluster B.
-
As a result they reported duplicate VMs and had to determine which instances to retain (splitbrain scenario).
They say the same behavior occurred when repeating the maintenance on the opposite site.
That happens some months ago, so I cannot confirm whether the witness was actually unreachable from both sides, whether recovery was automatic or manually triggered, or whether the original and recovered VMs were simultaneously running.
My understanding was that automatic recovery following an inter-site partition requires valid witness arbitration. However, I don’t want to assume that disconnecting the witness is a supported way to suppress automatic failover.
My questions are:
-
If both clusters lose access to the witness before losing connectivity to each other, under what conditions could automatic failover still occur?
-
What is the supported procedure to temporarily disable automatic recovery during a planned full-site shutdown or network isolation?
-
Is there a setting on the recovery plan, protection policy, or elsewhere specifically for this purpose?
-
How should pausing synchronous replication be coordinated with disabling automatic recovery?
-
Which events or logs would identify what triggered and authorized the recovery?
The goal is to understand what caused the issue and establish a documented maintenance procedure for future switch replacements. Links to official documentation or relevant KBs would be appreciated.
Thanks!