Is this a rational design?

I intend to build an exchange 2010 mail organisation. The brief requires that there be intrasite redundancy, IE a single server failure cannot cause our mail system to fail.

I envision 4 logical servers atop 2 physical servers

1) Mailbox server, DAG, Hub transport - atop physical 1

2) Exchange client Access, Network load balancing - atop physical 1

3) Mailbox server, DAG, Hub transport - atop physical 2

4) Exchange client Access, Network load balancing - atop physical 2

Note also a DAG witness will need to be set up elsewhere.

I havent constructed an exchange setup from scratch before so I need to know if this is a sensible approach that will work and doesn't amount to overkill.