Unexpected Automatic DR Failover Without Witness (Nutanix AHV + Prism Central)
Hi everyone,
I’m looking for opinions from anyone with deep Nutanix AHV Disaster Recovery experience because we recently encountered a very strange behavior that we’re still investigating with Nutanix Support.
Environment
Two Nutanix AHV clusters:
Production site
DR site
DR configured through Prism Central using Protection Policies and Recovery Plans.
Asynchronous replication.
No Witness VM deployed.
According to the design, failover should always be manual.
Network
Each site has two FortiSwitch top-of-rack switches configured in an active-active setup.
The customer upgraded the switches one at a time:
Upgrade started on Switch 1.
Switch 1 rebooted as expected.
Switch 2 remained online (as expected).
However, during the reboot, the production Nutanix cluster unexpectedly lost connectivity because traffic did not continue through Switch 2 as it should have.
So far, this points to a networking issue.
The strange part
Instead of simply having the production cluster become unavailable, the Recovery Plan automatically started on the DR site.
The protected VMs booted automatically on the DR cluster.
No one clicked “Failover.”
There is no Witness VM.
Replication is asynchronous, not synchronous.
Our understanding is that, without a Witness, the Recovery Plan should never execute automatically.
Investigation so far
We already opened a case with Nutanix.
Support has reviewed the logs and verified the Protection Policy and Recovery Plan configuration. According to them, the configuration appears correct, and they also agree that the observed behavior is unexpected. The investigation is still ongoing.
Questions
Has anyone ever experienced an automatic Recovery Plan execution without a Witness?
Is there any known bug in Prism Central or Nutanix DR that could trigger this behavior?
Could a temporary loss of communication between Prism Central and the production cluster somehow cause an unintended failover?
Are there any logs or internal services we should specifically ask Nutanix to inspect?
I’d really appreciate hearing if anyone has seen similar behavior or has ideas on what could explain this.
Thanks!