Multiple Global Protect Portal Realms

[MHaran]

Hi,

We have a Global Protect portal available to our users via a public facing URL.  Question I have is whether the Palo Alto solution can support multiple portals based on the same URL and interface IP to serve different authentication profiles.  Example:

All users using the GP Client for connection:

Group of Users (A):  Connect to companya.com  ---> Authenticate against Entrust for Portal ---- >  Authenticate against LDAP for Gateway

Group of Users (B): Connect to companya.com/mfa ---> Authenticate against MFA for portal ----> Authenticate against LDAP for Gateway

CompanyA.com would resolve to the same IP terminating on the same interface but I want to create a sub-domain for users to connect to subtly different URL to pick up different authentication profile but not have to create a different DNS with a different physical interface on Palo to achieve this.

Comments welcome

Regards