Who Me Too'd this solution

So here's what I ended up doing.

One portal.  It's on a floating IP that floats from firewall to firewall as needed.

Two gateways, one for each firewall.  IP is on the interface itself, not floating.  Each gateway has its own block of IPs for VPN terminations.  Portal is configured to have both gateways with equal priority (let the client decide where to connect). 

So far this is the cleanest and removes the routing problem.  The only issue is that failover is not clean for users that are currently connected as the client has to terminate one tunnel and reconnect to the other gateway, but it does work.