6.3 vSAN Storage Policies, Resilience (FTT) & Fault Domains

6.3 vSAN Storage Policies, Resilience (FTT) & Fault Domains

In traditional storage architectures, quality of service, redundancy, and performance characteristics are bound to physical or logical volumes (LUNs). If a database virtual machine requires RAID-10 mirroring while an archival server requires RAID-5 parity, an administrator must provision two completely separate LUNs and manage them independently. VMware vSAN abstracts these controls through Storage Policy-Based Management (SPBM), permitting administrators to define availability, performance, and security attributes on a granular, per-virtual-machine or per-virtual-disk (VMDK) basis.

---

Storage Policy-Based Management & The Quorum Architecture

vSAN enforces storage properties through declarative SPBM policies. When an administrator assigns a policy to a virtual disk, the vSAN Distributed Object Manager (DOM) interprets the policy rules and translates them into physical component layouts across cluster nodes:

• Primary Level of Failures to Tolerate (PFTT): Defines how many concurrent host, drive, or network partition failures an object must withstand without loss of availability.
• Secondary Level of Failures to Tolerate (SFTT): Utilized in Stretched Clusters to define the failure tolerance rule within a single site, secondary to the cross-site mirroring rule.
• Failure Tolerance Method: Dictates whether the object achieves availability through Performance (RAID-1 Mirroring) or Capacity (RAID-5/6 Erasure Coding).
• Number of Disk Stripes Per Object: Defines the minimum number of capacity devices across which each replica of an object is striped (default is 1; maximum is 12).
• Object Space Reservation: Dictates whether the virtual disk is thin-provisioned (0%, default) or thick-provisioned (100%).

The Object Quorum Model

To prevent data corruption and split-brain scenarios during network partitions, vSAN uses a strict majority voting quorum algorithm. Every component of a vSAN object (data replica, parity stripe, or witness) carries a designated number of votes:

• Quorum Requirement: An object remains online and accessible only when it has both sufficient available data components and more than 50% of its votes; votes alone cannot reconstruct missing data.
• Witness Components: A witness is an ultra-lightweight metadata component containing no user payload data. It exists solely to provide an odd vote to establish a decisive majority when two data mirrors lose communication with one another.

---

Resilience Mechanisms & Host Calculation Mathematics

The choice between RAID-1 Mirroring and RAID-5/6 Erasure Coding involves a direct trade-off between host count prerequisites, compute I/O overhead, and raw storage consumption:

RAID-1 Mirroring (Performance)

RAID-1 writes identical copies of data components across independent hosts:

• Host Count Formula: To tolerate n failures under RAID-1, vSAN requires a minimum of 2n + 1 hosts.
  • FTT=1: Requires 2(1) + 1 = 3 hosts (2 data mirrors + 1 witness component).
  • FTT=2: Requires 2(2) + 1 = 5 hosts (3 data mirrors + 2 witness components).
  • FTT=3: Requires 2(3) + 1 = 7 hosts (4 data mirrors + 3 witness components).
• Capacity Multiplier: RAID-1 carries a 2.0x capacity multiplier for FTT=1 (100% overhead). A 100 GB VMDK consumes 200 GB of raw capacity. For FTT=2, the multiplier is 3.0x (300 GB consumed per 100 GB VMDK).

RAID-5 Erasure Coding (Capacity)

RAID-5 distributes data stripes and parity calculations across hosts, tolerating a single failure (FTT=1):

• OSA RAID-5 (3+1 Scheme): Divides data into three data segments and one parity segment. Requires a minimum of four ESXi hosts. The capacity multiplier is 1.33x (33% overhead); a 100 GB VMDK consumes only 133 GB of raw capacity—delivering a 33% capacity savings compared to RAID-1.
• ESA Adaptive RAID-5: In the Express Storage Architecture, RAID-5 adapts dynamically based on cluster size: on clusters with 3 to 5 hosts, it uses a 2+1 scheme (minimum 3 hosts, 1.5x capacity multiplier); on clusters with 6 or more hosts, it uses a 4+1 scheme (the 6-or-more-host adaptive selection, 1.25x capacity multiplier).

RAID-6 Erasure Coding (Dual Parity)

RAID-6 delivers dual-failure tolerance (FTT=2) by calculating two distinct parity syndicates (P and Q parity):

• Scheme & Host Math: Operates as a 4+2 scheme (4 data segments + 2 parity segments), mandating a minimum of six ESXi hosts.
• Capacity Multiplier: Carries a 1.5x capacity multiplier (50% overhead); a 100 GB VMDK consumes 150 GB of raw capacity.
• Architectural Comparison: To achieve FTT=2, RAID-1 consumes 300 GB per 100 GB virtual disk, whereas RAID-6 consumes only 150 GB. RAID-6 cuts capacity consumption in half while providing the exact same double-failure protection.

Summary Table: Resilience Mathematics

---

Capacity Efficiency and Availability Are Separate

Compression, deduplication and erasure coding can reduce physical storage consumption in different ways. They do not eliminate the need for fault tolerance, free rebuild capacity or a backup. See the dedicated space-efficiency section for the 9.0 ESA global-deduplication capability and its applicability constraints; older claims that ESA never supports deduplication are incorrect.

Fault Domains (Rack & PDU Awareness)

By default, vSAN assumes that each physical ESXi host represents an independent failure domain. However, in enterprise datacenters, servers are physically installed in shared enclosures, such as server racks, blade chassis, or Power Distribution Unit (PDU) zones.

If five ESXi hosts in a cluster are installed in a single physical rack that suffers a top-of-rack (ToR) switch failure or power loss, all five hosts fail simultaneously. If redundant components of an object were placed across those hosts, the object immediately loses quorum and becomes inaccessible.

Fault Domain Configuration Rules

1. Component Separation: When Fault Domains are defined, vSAN guarantees that redundant mirror components, parity segments, and witness votes are distributed across separate fault domains rather than separate individual hosts.
2. Domain Count Requirements: The minimum number of fault domains matches the host count requirement for the selected policy:
   • FTT=1 (RAID-1): Requires at least three fault domains.
   • OSA FTT=1 (RAID-5): Requires at least four fault domains; ESA adaptive layouts differ.
   • FTT=2 (RAID-6): Requires at least six fault domains.
3. Balanced Sizing: Fault domains must be sized with balanced compute and storage capacity. If one fault domain contains significantly less storage than others, vSAN component placement will be constrained by the smallest domain.

---

Encryption Boundary

vSAN datastore encryption protects storage media; VM encryption protects a different layer. Key-provider recovery must be planned before enabling either. The workload-encryption section explains these distinctions, Native Key Provider backup and encrypted migration.

Official Reading

Use the official 2V0-16.25 objective guide for scope and Broadcom technical documentation for the installed 9.0 component. This independent lesson was reviewed October 18, 2026; actual deployment support depends on the applicable version and configuration.

Review Takeaways

• SPBM applies resilience and other storage rules to VM home objects and individual virtual disks.
• For a standard RAID-1 layout, FTT=1 needs three independent hosts; FTT=2 needs five.
• A 500 GB payload uses about 666.7 GB with OSA 3+1 RAID-5, before metadata, reservations and other overhead.
• ESA 9.0 adaptive RAID-5 uses 2+1 on three-to-five-host clusters and 4+1 on clusters with six or more hosts.
• Fault domains represent shared failure boundaries; accessibility needs both sufficient data and voting quorum.