For both the VxRail stretched cluster and the VxRail 2 node cluster, the networks on the vSAN witness virtual appliance must be properly configured to ensure proper cluster operations. The following guidelines must be followed:
- The vSAN witness virtual appliance needs to be configured with two separate networks during deployment:
- One for management called the “Management Network”
- One to support vSAN witness traffic called the “Secondary Network”
- The IP address assigned for vSAN witness management on the “Management Network” must be reachable by the vCenter instance supporting the VxRail cluster.
- The vSAN witness must be added to the vCenter inventory as an ESXi host to support vSAN witness traffic with the VxRail cluster.
- Each VxRail node and the vSAN witness must be able to connect over the vSAN witness traffic network.
- Each VxRail node in the cluster will be assigned an IP address to support vSAN witness network traffic.
- The vSAN witness virtual appliance will also be assigned an IP address to support vSAN witness network traffic on the “Secondary Network.”
Figure 62. Network relationships for vSAN witness and VxRail
- If the vCenter instance is supplied by VxRail, then vSAN management traffic on the “Management Network” needs to route to the VxRail vCenter Server network. This network will be configured by VxRail Manager during the initial build process.
- For a 2-node cluster planned with only layer 2 networking, and a VxRail-suppled vCenter, the IP address assigned for vSAN witness management needs to be in the VxRail vCenter Server Network subnet range.
- If the vCenter instance is customer-supplied, then vSAN management traffic on the “Management Network” needs to route to this vCenter instance.

Figure 63. With or without Witness Traffic Separation network
- If a Witness Traffic Separation (WTS) network is being planned for the VxRail cluster, then the vSAN witness traffic on the “Secondary Network” must be able to route to this network.
- If a Witness Traffic Separation (WTS) network is not being considered for the VxRail cluster, then the vSAN witness traffic on the “Secondary Network” must be able to route to the vSAN network planned for the VxRail cluster.