Before starting, verify the two vSAN nodes and witness are all on the same ESXi build version.
1. Decide whether you want to use the witnessPG or the management interface for vSAN traffic on the witness. Use an interface that can ping the management interfaces on both of the hosts.
2. Tag the interface for vSAN traffic only and do not tag it for anything else such as witness, vMotion, or management.
esxcli vsan network ip set -i vmkx -T=vsan
3. Tag the management interfaces on the hosts for witness traffic.
esxcli vsan network ip add -i vmkx -T=witness
4. Double-check the unicast table entries on both hosts.
esxcli vsan cluster unicastagent list
NOTE: you should only see two entries for the other two nodes. You will not see the local node entry.
If all of this is done correctly, the witness should join the cluster successfully.