You must not have an even number of HE-capable nodes. What you're running into is a
classic split-brain scenario, with only two nodes allowed to run the HE, and one of the
nodes down, the surviving host does not have quorum so does not know it can safely power
off the other machine (because obviously this surviving node, from its viewpoint, may have
somehow become isolated from the network while the other host is happily alive and running
the engine and controlling everything).
In clustering, you _never_ want two, or four, or six of something. One, three, five,
etc... because it must be impossible to have a "tie" situation when the
decisions are being made on which hosts are needing to be fenced.