You must configure I/O fencing to prevent corruption of shared data in the event of a network partition.
See About membership arbitration
See About data protection
In a campus cluster setup, you can configure I/O fencing as follows:
In this case, the site that has two coordinator disks has a higher probability to win the race. The disadvantage with this configuratoin is that if the site that has two coordinator disks encounters a site failure, then the other site also commits suicide. With this configuration, I/O fencing cannot distinguish between an inaccessible disk and a failed preempt operation.
This configuration ensures that fencing works even if one of the sites becomes unavailable. A coordinator disk in a third site allows at least a sub-cluster to continue operations in the event of a site failure in a campus cluster. The site that can access the coordinator disk in the third site in addition to its local coordinator disk wins the race. However, if both the sites of the campus cluster are unable to access the disk at the third site, each site gains one vote and the nodes at both the sites commit suicide.
See Veritas Cluster Server Installation Guide for more details to configure I/O fencing.