Hi CooL,
you are touching the only unsolved problematic point in using I/O fencing with your posting. In general, there is no remote instance in campus clusters like the stewart in global clusters. Global clusters have a quite similar problem as well. They solve it via the so called stewarts.
Fencing is based on the majority of accessible coordinator disks. And if they have to be distributed, then they have to be distributed via an uneven number of locations. Thats completely true, you have found the only possible solution. But this sounds uglier than it really is.
First you can make a third "site" only by putting one very small storage system on one of your locations in "a seperate fire protection area" with a seperate power plug (from a different power phase, if it is possible). Probably with an own fibrechannel switch. On some customer sites we realised this by having some very small Lampertz fireproof box. Ok, but this is somewhat costly.
Second, you have to think about the basic mechanisms again. There is no solution for this problem from the technical point of view. But the theoretical vision tells you, that an application breakdown because of losing all fencing disks (and an subsequentially booting of the surviving system afterwards without I/O fencing) is much better then a possible split brain (especially when the raid systems are mirrored and accessible from both sides of the cluster interconnect, on both sides of the network partition) with all the possible corruptions to the data. Because if you have two working sites after a network partition there is much more damage to the company because of inconsistant sets of data, what is nearly impossible to integrate into each other again, than by a downtime of some minutes. Additianlly the operators can decide in such a situation which site is to be started again.
So, please understand I/O fencing as a tool for preventing data corruption, not increasing the availability of the applications. In fact, you have to decide which one is more important. For you. And your company (customer).
I know exactly that this is not the message you wanted to hear, but from my point of view it is better to have a higher data protection than a higher availability. Luck are only this people who can have both. But this also means putting some money to the hardware.
Sorry for the bad news, but anyway have some good time
Roger
