I think I've sussed it!
I bound a secondary ip address to each of the network adapters in server1 and server2 using on a different subnet with no gateway specified (as there is no reason for internal host communication to route outside of the subnet). I was then able to ping and ssh between server 1 and 2 using 172.16.10.x host addresses.
so now the config looks like:
server1 eth1 remains the same (host,netmask,gw): 192.168.40.10 255.255.255.0 192.168.40.1
server1 eth0 remains the same: 192.168.20.10 255.255.255.0 192.168.20.1
server 2 eth0 remains the same: 192.168.40.11 255.255.255.0 192.168.40.1
server 2 eth1 remains the same: 192.168.20.11 255.255.255.0 192.168.20.1
server1 created new adapter eth1:0: 172.16.10.10 255.255.255.0 no gateway
server1 created new adapter eth0:0: 172.16.10.20 255.255.255.0 no gateway
server2 created new adapter eth1:0: 172.16.10.11 255.255.255.0 no gateway
server2 created new adapter eth0:0: 172.16.10.21 255.255.255.0 no gateway
- from the outside network I can talk to my webservice from primary.company.com and secondary.company.com. PBR allows me send packets back out on the interfaces they came in on.
- inside the network, server 1 can now talk to server 2 or any other host 172.16.10.0 network. No gateway is needed for the adapters eth1:0 or eth0:0.
- if either pix goes down the hosts in the internal network should still be able to talk to each other – will need to test