Proxmox High Availability That Actually Works: Fencing, Watchdogs and Quorum

High availability is the feature most likely to be configured and never verified — which means the first real test is a production outage. In Proxmox VE, a working HA setup is less about enabling a checkbox and more about three mechanisms you can reason about: quorum, fencing and the watchdog.

Quorum comes first

A Proxmox HA cluster needs at least three nodes, and it needs a majority to act. That majority is quorum, and it is the reason a two-node cluster is a trap: lose one node and the survivor cannot safely decide anything. Add a quorum device or a third node before you enable HA, not after.

Fencing is the safety net

Fencing is what prevents a split-brain — two nodes both convinced they own the same VM. Proxmox uses a hardware watchdog to fence a node that stops responding: when the watchdog timer is not fed, the node is reset, and its resources are guaranteed to be freed before the rest of the cluster takes over. The watchdog-mux service brokers this, and its status is worth monitoring explicitly.

The watchdog is not optional decoration

The watchdog only protects you if it is actually armed. Verify that the watchdog-mux service is active and that your hardware watchdog is configured, because a cluster that assumes fencing works and discovers it does not is the classic recipe for corrupted guests during a real failure.

Groups, priorities and policy

Once the mechanisms are sound, use HA groups and priorities to express intent: which resources fail over together, and which node they prefer. Migrate guests out of a node before maintenance, and keep in mind that HA is not a substitute for backups — it protects against host failure, not against data loss.

Prove it before you need it

The only honest test of HA is a rehearsal. Power a node off without warning, watch the resources relocate, and confirm the watchdog did its job. Do it quarterly. In our HA deep-dive, the assessment is exactly that: a controlled node failure that students must survive and explain.

HA is earned in rehearsals, not in promises. Schedule your next failover drill today.