You can create sub interface for the sub interface... because virtual interfaces can be created on the physical interfaces...... But two ip segments for a single vlan is possible in L3 switches / Routers. I never tried it in firewalls....
Here is the example in L3 switch
ip address 10.0.0.4 255.255.255.0 secondary
ip address 10.2.2.4 255.255.254.0