WatchGuard Firebox Firewalls
Find the right Firebox for your business.
In-stock appliances ordered before 4:15pm PT on a business day are processed the same day.
Four form factors: tabletop, rackmount, cloud and virtual
Shop physical Fireboxes (tabletop & rackmount), FireboxV for virtual, and Firebox Cloud for AWS/Azure.
Tabletop Firebox Appliances
Built-in PoE+ with optional Wi-Fi or 5G. Ideal for small offices and branches.
Secure Smaller Sites Now
Rackmount Firebox Appliances
1U models for growth, modular ports and dual power.
Explore Security That Scales
Featured Firebox Models
Three models spanning the range — a small-office tabletop, a branch tabletop with SFP+, and a rackmount for high-throughput sites. The full lineup covers everything in between.
Both figures are WatchGuard’s published throughput. Firewall (UDP 1518) is measured with every security service off and is the headline number; UTM Full Scan is measured with them all on, and is the one to size against. WatchGuard datasheets
| Model | Intended deployment | UTM Full Scan inspected throughput |
Firewall (UDP 1518) no services running |
Ports | Wireless | Price |
|---|---|---|---|---|---|---|
 Firebox T125 |
Small and home offices Rated for 25 users |
510 Mbps | 2.28 Gbps | 1 × 2.5GbE 4 × 1GbE |
Wi-Fi 7 on the T125-W | See pricing Request a Quote |
 Firebox T145 |
Branch offices and SD-WAN edge Rated for 50 users |
710 Mbps | 3.9 Gbps | 1 × 2.5GbE 4 × 1GbE 1 × SFP/SFP+ |
Wi-Fi 7 on the T145-W | See pricing Request a Quote |
 Firebox M5800 |
High-throughput networks Rackmount |
11.3 Gbps | 87 Gbps | — | Not available on rackmount | See pricing Request a Quote |
Size on UTM Full Scan. That is throughput with every security service inspecting; the UDP 1518 column is the same appliance with nothing switched on. This site carries no published port detail for the M5800 — its current-generation replacement is the M5850. Full figures on the datasheets page.
Basic or Total Security Suite?
Whichever appliance you pick, you also choose a service level. Basic covers the network; Total adds sandboxing, endpoint coverage and cross-product correlation.
Standard Support provides technical support and software updates. Basic Security Suite adds essential threat protection, while Total Security Suite adds advanced security services. Coverage depends on your selected subscription. What Standard Support covers
| Service | Basic Security Suite | Total Security Suite |
|---|---|---|
| Intrusion Prevention (IPS) | Included | Included |
| Gateway AntiVirus | Included | Included |
| Web filtering & URL blocking | Included | Included |
| Application Control | Included | Included |
| Email security (spamBlocker) | Included | Included |
| Network visibility & reporting | Included | Included |
| APT Blocker (cloud sandboxing) | Not included | Included |
| IntelligentAV | Not included | Included |
| DNSWatch phishing protection | Not included | Included |
| EDR Core endpoint visibility | Not included | Included |
| ThreatSync XDR correlation | Not included | Included |
| Support level | 24×7 | Gold 24×7 |
Suites are licensed per appliance for a fixed term and tied to that appliance’s serial number — a suite bought for a T145 does not move to an M5800. When a term lapses, the affected security services stop and traffic may be affected, depending on your configuration. Service definitions on our security services page.
Authorized Reseller
GuardSite, a division of BlueAlly, is an Authorized WatchGuard Reseller
Buy with confidence. Genuine WatchGuard hardware, licensing, and expert help from a long-standing partner. We size, ship, and support Firebox deployments for SMBs to enterprise.
WatchGuard Trade Up Program
Current WatchGuard customers can replace eligible appliances with new Firebox, FireboxV, or Firebox Cloud models via dedicated Trade Up SKUs. Trade-up pricing is available by quote.
- Check your current appliance against the eligibility chart
- Purchase the Trade Up SKU that matches your device
- Activate the new device and retire the old one
- Trade Up pricing is quoted per device, not published
Beyond the appliance
The rest of the WatchGuard stack, all managed from the same console. Appliances and security suites are covered above.
FireCloud
ZTNA, FWaaS, VPN and SWG for users who are not behind a Firebox.
WatchGuard Cloud
One console for firewalls, APs and services, with live visibility.
ThreatSync+ NDR
Network detection and response that flags traffic anomalies in real time.
Firebox FAQs & Product Family
Sizing, licensing and the differences between form factors, answered in full.
Specifications on this page come from WatchGuard’s published datasheets and are reproduced, not restated. Datasheets. Last reviewed .
Work through it in three passes.
1. Rated users. WatchGuard publishes a user rating for every model — 25 for the T125, 50 for the T145, 250 for the M395, and so on. That rating already assumes full inspection, so if your headcount fits, the appliance fits. Start there, not at the throughput figures.
2. Inspected throughput. Check the UTM Full Scan number, which is measured with every security service running. Ignore the Firewall (UDP 1518) figure for sizing — it is measured with everything switched off and reads several times higher than production.
3. What forces a tier jump. An internet circuit faster than 1 Gb needs a multi-gig WAN port to be usable. Heavy HTTPS inspection is the most expensive work a Firebox does and will pull you up a model. Sites that terminate many VPN tunnels should size on tunnel count instead.
Compare the featured models · All tabletop specs · All rackmount specs
Two separate things, bought separately.
The appliance is a one-time purchase you own outright. Standard Support provides technical support and software updates. Coverage depends on your selected subscription.
The security suite is a term licence tied to that appliance’s serial number. Basic Security Suite covers the network: intrusion prevention (IPS), Gateway AntiVirus, web and application filtering, spamBlocker and reporting. Total Security Suite adds APT Blocker cloud sandboxing, IntelligentAV, DNSWatch, EDR Core and ThreatSync XDR, plus Gold support.
A suite does not transfer between appliances, and there is no perpetual option. An expired subscription affects security services and may disrupt traffic; it does not guarantee a seamless fallback to firewall-only operation. The impact depends on your configuration and management mode. Renew before expiration to maintain protection.
Where it runs, and how it is sized.
Firebox Cloud runs in public cloud — AWS and Azure — and is sized purely on user count: Small 500, Medium 3,000, Large 6,000, XLarge unrestricted. Use it to put a Firebox in front of workloads you host with a cloud provider.
FireboxV runs on your own hypervisor, VMware or Hyper-V. It is sized on users too (Micro 5, Small 50, Medium 250, Large 750) but also exposes virtual interface and VLAN counts, and includes EDR Core seats. Use it to consolidate a physical Firebox into infrastructure you already run.
Both take the same security suites as the hardware. Firebox Cloud · FireboxV
None of these are standard across a range — they are per-model options.
PoE+ (powering cameras or access points from the firewall) is on the T45-PoE, T45-W-PoE and T85-PoE. Wi-Fi is on the -W models only: Wi-Fi 7 on the T115-W, T125-W and T145-W, Wi-Fi 6 on the T25-W and T45 wireless variants. 5G is on the T45-CW, which has a built-in modem.
Rackmount M-series appliances have no wireless option. Check the spec column on the tabletop comparison before assuming a feature is present.
Tabletop (T-series and NV5) for small offices, branches and remote sites. Rackmount (M-series) for corporate sites and data centres, with modular ports and dual power on the larger models. Firebox Cloud for AWS and Azure. FireboxV for VMware and Hyper-V.
All four run the same Fireware operating system and take the same security suites, so the choice is about where the appliance sits, not what it can do. See all four
Yes. Every Firebox terminates VPN tunnels and supports SD-WAN at no extra licence cost — both are part of the base Fireware feature set, not a suite add-on. Tunnel capacity varies by model: 10 branch-office tunnels on a T125, 25 on a T145, 10,000 on an M4850, unlimited on the M5850 and above.
For users who never sit behind a Firebox, WatchGuard sells FireCloud separately — ZTNA, firewall-as-a-service and secure web gateway delivered from the cloud. FireCloud Total Access
Firebox Product Family
Firebox firewalls deliver performance-driven protection with models for every environment:
All models ship fast. Compare Tabletop · Compare Rackmount or request a quote.
Firebox specs and documents
Comparison charts first, model datasheets where you need the full sheet.
Comparison chart
Tabletop spec comparison
Every current T-series model side by side: rated users, UTM Full Scan, ports.
Comparison chart
Rackmount spec comparison
Every current M-series model side by side, from the M295 up.
Brochure (PDF)
Firebox Network Security
The appliance range in a few pages, for stakeholders.
Datasheet library
All WatchGuard datasheets
Per-model sheets for anything not listed here.
Get a quote on your Firebox
Send the models you are weighing up, or describe the site and we will size it. Quotes come back with current pricing, the matching security suite, and lead times.