You must configure I/O fencing to prevent corruption of shared data in the event of a network partition.
See About membership arbitration.
You can use coordinator disks, coordination point server (CP server), or a mix of both as coordination points to configure I/O fencing.
In a campus cluster setup, you can configure I/O fencing as follows:
Two coordinator disks at one site and one coordinator disk at the other site
In this case, the site that has two coordinator disks has a higher probability to win the race. The disadvantage with this configuration is that if the site that has two coordinator disks encounters a site failure, then the other site also commits suicide. With this configuration, I/O fencing cannot distinguish between an inaccessible disk and a failed preempt operation.
One coordinator disk in each of the two sites and a third coordinator disk at a third site
This configuration ensures that fencing works even if one of the sites becomes unavailable. A coordinator disk in a third site allows at least a sub-cluster to continue operations in the event of a site failure in a campus cluster. The site that can access the coordinator disk in the third site in addition to its local coordinator disk wins the race. However, if both the sites of the campus cluster are unable to access the disk at the third site, each site gains one vote and the nodes at both the sites commit suicide.
You can also configure a coordination point server (CP server) at the third site instead of a third coordinator disk.
See the Cluster Server Installation Guide for more details to configure I/O fencing.