Run the command esxcli vsan cluster get on one of the ESXi hosts and check if Sub-Cluster Member has a value of 3 (2 nodes and witness) members.
Also can you verify in which networking mode vSAN traffic is operating? Since version 6.6, vSAN relies on unicast traffic.
Are you also getting the warning regarding "All hosts have a vSAN vmknic configured" for the witness node?
Can you SSH to the witness node and paste the output of "esxcli vsan network list". If there are 2 then please check if they are on the same subnet or not.
On your vSAN Witness Appliance, are vmk0 and vmk1 both on the same subnet?
If so, traffic that is tagged "vSAN Traffic" will go out vmk0, not vmk1. This is a multi-homing issue: https://kb.vmware.com/kb/2010877
I wrote a blog post about this that goes into more detail specific to the traffic configurations for 2 Node Direct Connect here: https://blogs.vmware.com/virtualblocks/2018/05/16/witness-host-traffic-tagging/
Also, if using ping to check connectivity, be sure to use vmkping -I vmkX when pinging an interface to connectivity
example pinging from vmk1 on a data node to vmk1 on a vSAN Witness Appliance: vmkping -I vmk1 192.168.110.23