VCHA relies on a heartbeat network and quorum between the three nodes to avoid a split-brain scenario. The active node is the only node with a frontend or production IP address. The passive and witness nodes only have active IP addresses on the heartbeat network. This architecture is shown in the following diagram, with the embedded PSC deployment topology:

There are several failure scenarios that will result in a failover from the active node to the passive node:

• vCenter service failure (or PSC service failure, if an embedded PSC is used)
• VCSA operating system failure
• Entire VM crashes
• Underlying ESXi host crashes due to hardware failure or hypervisor crashes
• Active node isolation on the heartbeat network

There are also several failure scenarios that won't cause a vCenter HA failover from the active node to the passive node:

• Passive node VM failure
• Witness node VM failure
• Frontend network interface failure on the active node

• External PSC failure
• vSphere Client service failure:
  • Services that rely on APIs stay available during this type of failure