Witness traffic separation allows you to use a VMkernel adapter for vSAN witness traffic that is different from the adapter for vSAN data traffic.
By default, when you stretch a cluster, the vSAN-tagged VMkernel adapter is used to carry traffic destined for the vSAN witness host. With witness traffic separation, you can use a separately tagged VMkernel adapter instead of extending the vSAN data network to the witness host. This feature allows for a more flexible network configuration by allowing for separate networks for node-to-node and node-to-witness communication.
You must have a stretched cluster before you can configure it for witness traffic separation.