We are using an A-P pair of FWs and keep portal on them.
If one FWs fail then there's the other and if both FWs fail then there's the cached portal credentials.
Behind the portal sit several gateways.
Hope it helps!
... View more