Creating DAG where to put the Witness Server and Network for Cluster

Hi,

I'm creating a DAG in our 2 server Exchange 2010 SP2 environment (hosted on vSphere 5). As this is a fairly small deployment, both servers have the following roles HT CAS MBX UM.

Q1) I've read that the Witness Server can't be part of the DAG so where should I put it? I could build another server and put it on that but what would happen if that went down for whatever reason?

Q2) I've also noticed that I need to use a separate network for the clustering traffic. Is this true? And if so, does this clustering network HAVE to be on a separate subnet or can it just be separate NICs and IPs?

Any help appreciated.

Thanks