3.5 vSAN Resilience & Data Availability: FTT, Fault Domains, and Stretched Clusters
Key Takeaways
- Failures to Tolerate (FTT) is a storage policy attribute; RAID-1 mirroring for FTT=n requires 2n+1 fault domains, so FTT=1 needs three and FTT=2 needs five.
- vSAN OSA erasure coding uses a fixed 3+1 RAID-5 requiring four hosts and a 4+2 RAID-6 requiring six; vSAN ESA uses adaptive RAID-5, choosing 2+1 on clusters of up to five hosts and 4+1 on six or more.
- A fault domain groups hosts that share a failure boundary such as a rack, so vSAN places replicas across domains rather than across hosts that could fail together.
- A stretched cluster spans two data sites plus a witness host that stores only witness components and casts the tie-breaking vote; the witness holds no VM data.
- vSAN distinguishes ABSENT components, which trigger rebuild only after the 60-minute repair delay, from DEGRADED components, which begin rebuilding immediately because the failure is known to be permanent.
3.5 vSAN Resilience & Data Availability: FTT, Fault Domains, and Stretched Clusters
Exam Focus: The blueprint calls out "identify the options for Resilience and Data Availability in VMware vSAN" as a discrete objective. Scenario items typically supply a host count and a required protection level and ask which placement scheme is possible — so the host-count arithmetic matters as much as the concepts.
Failures to Tolerate (FTT) and Placement Schemes
Failures to Tolerate (FTT) is an attribute of a vSAN storage policy, not a cluster-wide switch. It states how many concurrent failures of a host or fault domain an object must survive. Because it lives in policy, two VMs on the same cluster can carry different protection levels.
vSAN implements FTT through one of two placement families:
RAID-1 Mirroring
Full copies of each object are written to separate fault domains, with witness components breaking ties. Mirroring costs the most capacity and delivers the lowest write amplification.
| Protection | Data copies | Minimum fault domains | Capacity overhead |
|---|---|---|---|
| FTT=1 (RAID-1) | 2 | 3 | 2.0× |
| FTT=2 (RAID-1) | 3 | 5 | 3.0× |
| FTT=3 (RAID-1) | 4 | 7 | 4.0× |
The rule generalises to 2n+1 fault domains for FTT=n. The extra domain exists to host witness components so a surviving partition can establish a quorum of more than 50 percent of votes.
RAID-5 and RAID-6 Erasure Coding
Erasure coding stores data plus parity fragments instead of whole copies, trading write amplification for a large capacity saving. The scheme differs between the two vSAN architectures, and this is a frequent exam discriminator.
| Architecture | Scheme | Fragments | Minimum hosts | Capacity overhead |
|---|---|---|---|---|
| OSA RAID-5 (FTT=1) | Fixed 3+1 | 3 data + 1 parity | 4 | 1.33× |
| OSA RAID-6 (FTT=2) | Fixed 4+2 | 4 data + 2 parity | 6 | 1.5× |
| ESA RAID-5 (FTT=1) | Adaptive 2+1 | 2 data + 1 parity | 3 | 1.5× |
| ESA RAID-5 (FTT=1) | Adaptive 4+1 | 4 data + 1 parity | 6 | 1.25× |
| ESA RAID-6 (FTT=2) | Fixed 4+2 | 4 data + 2 parity | 6 | 1.5× |
Adaptive RAID-5 is an ESA capability: on clusters of up to five hosts vSAN uses the 2+1 layout, and on six hosts or more it uses the more efficient 4+1 layout. Note the boundary carefully — 4+1 requires six fault domains, not five, because each of the five fragments needs its own domain plus room to rebuild.
[!IMPORTANT] Why ESA changes the erasure-coding calculus. In OSA, RAID-5 and RAID-6 carried a real write penalty, so mirroring was the default for performance-sensitive workloads. ESA's log-structured design writes and acknowledges at the performance leg before computing parity, which allows erasure coding at mirror-like performance. In ESA the space-efficient scheme is therefore the sensible default rather than a compromise.
Fault Domains: Failure Boundaries, Not Hosts
By default vSAN treats every host as its own fault domain. That is correct only if hosts fail independently. When twelve hosts occupy three racks, a single rack power loss takes out four hosts at once — and unconfigured vSAN may have placed both mirror copies inside that rack.
Configuring fault domains groups hosts by shared failure boundary (rack, chassis, or power feed). vSAN then places replicas and parity fragments across domains, so a whole-rack outage costs at most one component per object.
The host-count arithmetic changes accordingly: FTT=1 with RAID-1 needs three fault domains, which with rack-level grouping means three racks rather than three hosts.
Stretched Clusters and the Witness
A stretched cluster extends a single vSAN cluster across two geographically separated data sites to survive the loss of an entire site. It has three participants:
- Preferred site and secondary site, each holding a complete copy of protected data.
- A witness host at a third location, which stores only witness components — metadata, never VM data. Its role is to cast the deciding vote so that when the inter-site link fails, exactly one site retains quorum and the other stops serving I/O. This prevents split-brain.
Protection in a stretched cluster is expressed on two axes:
- Site disaster tolerance governs cross-site mirroring.
- Failures to tolerate governs protection within each site, so a site can survive a local host failure without falling back to the remote copy.
A related topology, the two-node cluster, applies the same witness concept to a pair of hosts at a remote or edge location.
Component States and Repair Behaviour
When vSAN loses access to a component it classifies the failure, and the classification determines how fast it reacts.
| State | Meaning | vSAN response |
|---|---|---|
| ABSENT | Component unreachable, but the failure may be transient — a rebooting host, a pulled network cable, maintenance mode | Waits out the repair delay (default 60 minutes) before rebuilding, avoiding a costly resync for a host that is coming back |
| DEGRADED | Component is on hardware that has failed permanently — a dead device reporting errors | Begins rebuilding immediately, because waiting cannot help |
[!TIP] The maintenance-mode connection. The 60-minute repair delay is precisely why patching a host does not trigger a fleet-wide resync storm. It is also why Ensure accessibility is the usual maintenance-mode choice: it evacuates just enough data to keep objects available rather than fully evacuating, which would be a Full data migration.
Exam Watch: Key Scenarios and Candidate Traps
[!WARNING] Count fault domains, not hosts. A six-host cluster that has been carved into three rack-level fault domains cannot satisfy RAID-6, which needs six domains. The host count looks sufficient; the domain count is not.
[!IMPORTANT] The witness never holds data. If an answer option claims the witness host stores a third copy of virtual machine data, it is wrong. The witness stores witness components only.
A vSAN ESA cluster contains six hosts, each configured as its own fault domain. An administrator applies a storage policy specifying RAID-5 erasure coding. Which data placement scheme will vSAN use, and what is the resulting capacity overhead?
A twelve-host vSAN cluster is distributed across three racks and has been configured with three rack-level fault domains. An administrator attempts to apply a RAID-6 storage policy and the operation fails. What is the cause?
In a vSAN stretched cluster, what does the witness host store, and what is its function during an inter-site network partition?
An administrator places an ESX host into maintenance mode to apply a patch. Ten minutes later they observe that vSAN has not begun rebuilding the components that resided on that host. Is this expected, and why?