Witness server version and network operation

I am doing some preliminary research on providing a mirroring solution, as part of a new project. Management don't want to make a great deal of budget available for this, so I'm being asked to shoehorn it into existing kit (of course, the project is allowed new kit!).

Essentially, the proposed server for witnessing is a lives in a different VLAN from the new home of the project servers and runs a different version of SQL Server.

A firewall enforces separation between the VLANs such that the witness is on the outside, while the project servers are on the inside. I need to know whether I can rely solely on the implicit allow-inside-to-outside rule, or whether I need to allow explicit outside-to-inside traffic (for the witness endpoint port); and whether or not I need to add special rules to prevent the firewall dropping the connection after a certain amount of time.

So, I have a couple of questions that I can't seem to find any definitive answer on. I'm hoping that they are actually faily straightforward to someone who has actually done some or all of this:

1. Does the witness server instance have to be of the same version (not edition) as the mirrored pair (i.e. can a mirrored pair running on 2008R2 be witnessed by a 2005 or 2008 instance)?

2. How does the TCP network traffic flow between the pair and the witness?

   1. Is it a continuous open/half-open connection, with regular traffic flow; or is it more like a 'ping' that does the full open/close each time?
   2. Which server 'initiates' the connection — do the paired servers connect to/ping the witness, or does the witness connect to/ping the paired servers? Or both, depending on circumstance?