Need soem help with a WatchGuard Firebox x500 and external IPs

Since i do not know what that is, I doubt it.  Or do you mean Fireware?  If that is the case, then I don't think so... I see under the licened features:
Firebox model upgrade
Mobile User VPN
Branch office VPN
SpamScreen License
High-availability License
WebBlocker
and 3 port upgrade

You can different subnet on the external interface itself; or on any other interface if you wish.

Let's say you have 1.1.1.1/24 as subnet which your primary subnet and already working on the existing network [both for incoming and outgoing traffic].

Now you also have 2.2.2.2/28 subnet which you never used before but would like to use now.
1. Add 2.2.2.2/28 as secondary network on external interface [in policy manager, click Network->Configuration->select External, click Configure; select Secondary Tab; click Add]; you can have the server on any physical interface as you wish.
2. You can configure static NAT or 1-1 NAT for the server as you deem necessary [please let know if you need steps for this] using a policy.
3. Here the only prerequisite is that your ISP should properly forward all traffic for 2.2.2.x network to your firebox external interface.

If you do not wish to perform any NAT but would like the new server on 2.2.2.x network then this setup would be different and the steps would be entirely different as well.

Please let know if you need more details.

Thank you.

I think I understand what you are talking about.  

How do I confirm if my ISP is routing traffic to that IP?    They just gave me the Range of x.x.x.160-167, told me the  gateway was 166, network was 160 and bradcast was 167,  Does that mean I can put in any of the other IPs like 161-165 as a secondary network on the external interface?

Continuing with my example; if you ping 2.2.2.2 from any other internet connection and the traffic is forwarded to your firebox; in traffic monitor you would see denies; this would confirm that the ISP is forwarding traffic correctly.

To make sure things are pretty correct, you can also try telnet on different port [can be random too] and also can use some tool like nmap and do a port/ip sweep. For all attempts you should see denies in traffic monitor.

Thank you.

But if the other IP that I want to add isn't another network, it is just another IP in my block.  Should I be looking at it in a different point of view? Or is the term secondary network just referencing another IP?

If want the second external IP to be x.x.x.162, do I enter the secondary network as x.x.x.162/30?

Then for the static NAT policy, how does the Firebox know to route 443 and 80 requests from the external IP x.x.x.162 to my internal machine and not get it mixed up with my other external IP (x.x.x.166) static nat policies?  The drop down on the static nat menu only shows the interface names, or will the drop down have two external entries in the drop down menu?.  

Thanks again in advance.  I haven't work with a firebox before and hte logic seems a little different on them.  The last hefty firewall I dealt with was a symantec and to do this you would just enter a static IP into the interface config from your pool.  Then write rules with this new interface name instead.

Looks like you are using version 7.x of WG software; I was listing steps as per 8.x or higher version.

The steps would be different for you. Sorry for confusion I thought the IP address subnets are different; if the IP addresses are in the same subnet as external interface IP, then you would Aliases instead.

Once added, when you click Add, NAT, the IP address and External would start appearing.

Consider this example, 6 total IP address from ISP, 1.1.1.1-1.1.1.6; 1.1.1.7 is default gateway, 1.1.1.1 is assigned to external interface and the mask is 29.
Now to use 1.1.1.2 and .3 for different servers and use static NAT, then add IP 1.1.1.2 and 1.1.1.3 as aliases on external interface.

One thing to note here is; by default if you configure static NAT, the oubound traffic from server takes the IP of the external interface rather than the public IP with which it came in; if you wish to use same IP, then use 1-1 NAT instead.
For eg, if you host SMTP server, many servers would reject email if they perform reverse DNS lookup; if your external IP address and MX addresses are different.
In such case you should use 1-1 NAT.

If you have addresses which are in different subnet than the IP of your external interface then we would use secondary tab.

Please let know if you need more details.

Thank you.

Uh oh, looks like I have started a problem that is bigger than not having an IP!  Now it is constantly rebooting.  I don't even have time to log into it vefore it reboots again, how do I get it to stop this behavior?

Did this happen after you made some change; take the unit off the network [disconnect the untrust and trust cables]; connect a cross-over cable from laptop (with WG software installed) to the trust interface.
Save the old config back OR check if the device boots fine now and if you can connect through management software.

If nothing, reset the unit to factory default and then load the last good known config to the unit.

To reset to factory defaults, power down the unit; press the UP arrow; power on the unit; keep pressing the UP arrow key till the LCD display shows the Firebox is running in safe mode. When the Firebox runs in safe mode, it is running in factory-default mode. In factory-default mode, the Firebox trusted interface is set to 10.0.1.1.
Open policy manager and load the configuration which you wish to save to firebox [here you have option to reconfigure firebox from scratch if you wish so!].
Finally select File > Save > To Firebox. Save your configuration to the Firebox at IP address 10.0.1.1, with the administrative passphrase admin.
After the Firebox restarts with its new configuration, change the passphrases for the Firebox. Select File > Change Passphrases to set new passphrases.

Please implement and update.

Thank you.

One CORRECTION; as you are running version 7.x; the default IP of the unit would be 192.168.253.1 and wg would be the passphrase instead and you would be prompted to set new passphrases upon save.

Also, change the laptop IP to the same subnet 192.168.253.x/24 if you reset the unit to factory defaults, before loading image from the laptop policy manager.

Thank you.

Well, now it seems the problems are not related to the network changes I made.  If I hard shut down the unit, it will boot fine back into whatever config I loaded, new or old.  If I do a soft reboot, through the policy manager it will constantly crash and reboot itself and then just get stuck in  the endless cycle.  I can then just flip the switch, and then after a couple of times, it boots normal...  have you ever seen any behavior like this?  Is this a sign it is starting to fail?  I hate blaming hardware for my headaches, but this one seems to be an actual problem...  I also reset it to factory, saved that to the firebox and then saw the same behvior with almost nothing configured other than the trusted interface.

Please see answer as attachment; for some reason unable to SUBMIT answer.

I reset to factory defaults, and then only configured the Trusted Interface to get it to talk to my normal network and workstation.  I then hit reboot, once I confirmed connecting to it from there, and it got stuck in rebooting over and over again.  There were no other changes made.  It was stuck until I cycled the switch in the back.