This message was deleted.

I rarely hear of problems with home users accessing high-order ports outbound, it's usually inbound that gets filtered. That said, the two virtual servers are completely independent. There's no "transfer", the client just gets a launch ticket that tells it to use gateway2 instead of gateway1. If you use a different IP address then you'll need a separate domain name and certificate which is why people usually try to stick with a different port than a different IP.

Thanks Mike, so if a separate domain name + IP + cert is no problem, it should work and I am able to present the access via 443

correct, you would then configure storefront to use that second domain name for HDX routing

Worked like a charm. configured the certauth gw as "Only Authentication" and the additional gw at 443 as "Only HDX routing". so now only one certauth and all traffic based on 443. Thanks Mike.