Maybe watchdog functionality, if the network is saturate and corosync cannot operate correctly, the watchdog will kick in (automatic reboot when the watchdog counter runs out). Stop the network interface on which corosync operates, few seconds later the server will reboot.
The best practice is...