In short
A WatchGuard firewall is a Firebox appliance: tabletop T Series for small offices and branches, rackmount M Series for 100 to 10,000 users, sold with Standard Support or a Basic, Prime or Total Security Suite and managed in WatchGuard Cloud. We quote each model with its suite, give the exact part number in the quote and can install.
Shop network hardware
Add products and licences to your basket, then check out when you are ready.
WatchGuard Firebox models compared
| Model | Type | Interfaces (WatchGuard datasheet) | UTM throughput, full scan | Suits |
|---|---|---|---|---|
| Firebox T115-W | Tabletop, Wi-Fi 7 built in | 3 x 1 GbE | 280 Mbps | Micro offices |
| Firebox T125 / T125-W | Tabletop, optional Wi-Fi 7 | 1 x 2.5 GbE, 4 x 1 GbE | 510 Mbps | Small offices |
| Firebox T145 / T145-W | Tabletop, optional Wi-Fi 7 | 1 x 2.5 GbE, 4 x 1 GbE, 1 x SFP/SFP+ | 710 Mbps | Small offices and branches |
| Firebox T175 | Tabletop | 2 x 2.5 Gbps, 4 x 1 Gbps, 2 x 10 Gbps SFP+ | 2.30 Gbps | Larger branches |
| Firebox T185 | Tabletop, 2 PoE+ ports | 4 x 1 GbE, 4 x 2.5 GbE, 1 x SFP/SFP+ | 1.83 Gbps | Larger branches |
| Firebox T45-CW | Tabletop, Wi-Fi 6 and 5G modem | 5 x 1 GbE | 557 Mbps | Sites on mobile data |
| Firebox M295 | 1U rackmount | 4 x 2.5Gb, 4 x 1Gb, 2 x SFP+ | 1.85 Gbps | 100 users |
| Firebox M395 | 1U rackmount | 12 x 2.5 Gbps, 2 x 1 Gbps SFP, 2 x 10 Gbps SFP+ | 3.85 Gbps | 250 users |
| Firebox M495 | 1U rackmount | 12 x 2.5 Gbps, 2 x 10 Gbps RJ45, 2 x 1 Gbps SFP, 2 x 10 Gbps SFP+ | 6.30 Gbps | 500 users |
| Firebox M595 | 1U rackmount | 12 x 2.5 Gbps, 2 x 10 Gbps RJ45, 2 x 1 Gbps SFP, 4 x 10 Gbps SFP+ | 7.20 Gbps | 850 users |
| Firebox M695 | 1U rackmount | 12 x 2.5 Gbps, 2 x 10 Gbps RJ45, 4 x 1 Gbps SFP, 4 x 10 Gbps SFP+ | 10.80 Gbps | 1,250 users |
| Firebox M4850 | Rackmount, redundant power | 8 x 1 Gbps, 4 x 1 Gbps SFP, 6 x 10 Gbps SFP+, 2 x 25 Gbps SFP28, expansion bay | 19.10 Gbps | 2,500 users |
| Firebox M5850 | Rackmount | 8 x 1 Gbps, 6 x 1 Gbps SFP, 8 x 10 Gbps SFP+, 4 x 25 Gbps SFP28 | 27.00 Gbps | 7,500 users |
| Firebox M6850 | Rackmount | 8 x 1 Gbps, 6 x 1 Gbps SFP, 10 x 10 Gbps SFP+, 4 x 25 Gbps SFP28, 2 x 100 Gbps QSFP28 | 36.50 Gbps | 10,000 users |
Figures are WatchGuard datasheet figures; WatchGuard notes that "Throughput rates are determined using multiple flows through multiple ports and will vary depending on the environment and configuration". User counts in the Suits column are WatchGuard's 'Ideal for' figures for the M Series; for the tabletop models it is our summary of WatchGuard's positioning. WatchGuard also makes the Firebox NV5 for "kiosks, ATMs, and remote office equipment". Every model, with its datasheet link, is on the tabletop and rackmount pages.
Shop firewalls
See all 18 productsCompare, then add to your basket
Every product in our shop lists its order codes and licences, ready to add.
Security suites sold with a Firebox
Each Firebox is sold with a support licence or a security suite, for the same term:
- Standard Support: WatchGuard says it "includes centralized management, full VPN capabilities" and "built-in SD-WAN" on top of stateful firewalling, with WatchGuard's own technical support.
- Basic Security Suite: adds IPS, application control, WebBlocker, spamBlocker, Gateway AntiVirus, geolocation blocking, botnet detection and Tor exit node blocking.
- Prime Security Suite: adds APT Blocker, DNSWatch and Shadow AI. WatchGuard offers Prime "Only available for new models, launched after 2025": the T115-W, T125, T145, T175, T185 and the M295 to M6850.
- Total Security Suite: adds Network Management, IntelligentAV, ThreatSync (XDR) and EDR Core, with the longest WatchGuard Cloud log retention (365 days, against 45 on Basic and 90 on Prime).
The suite contents are from WatchGuard's T185 and T175 datasheets. Licence part numbers, renewals and the MSP options are on WatchGuard Firebox licensing (opens in a new tab) on softwarelicensing.uk.
WatchGuard Cloud
Fireboxes, access points and WatchGuard's other products are managed in WatchGuard Cloud. On the tabletop range WatchGuard says "managing firewall security in WatchGuard Cloud gives you centralized control and real-time insights". A Firebox needs an active Standard Support or suite licence to be added to WatchGuard Cloud, so we quote the two together. Every T Series datasheet also lists multi-WAN SD-WAN, dynamic routing ("RIP, OSPF, BGP") and logging to "WatchGuard Cloud & Dimension, Syslog, SNMP v2/v3".
Not sure what you need?
Tell us about your sites and we will recommend the right kit and licences.
WatchGuard access points
WatchGuard describes its access points as delivering "Wi-Fi 6 and Wi-Fi 7 high-performance wireless networking with centralized cloud management":
- Indoor: AP130 (2x2 Wi-Fi 6, low density), AP230W (wall plate with extra wired ports), AP330 (2x2 with a dedicated scanning security radio), AP340 (WatchGuard's Wi-Fi 7 model, tri-band 2x2x2 with a 10 Gbps port) and AP432 (4x4 Wi-Fi 6, high density).
- Outdoor and rugged: AP332CR and AP430CR.
- Licences: Standard Wi-Fi or USP Wi-Fi, both with WatchGuard Cloud management; USP Wi-Fi adds Syslog output, IKEv2 VPN features and 30-day reporting.
Every model and part number is on WatchGuard access points, and the Wi-Fi licences on WatchGuard Wi-Fi licensing (opens in a new tab). WatchGuard also builds Wi-Fi 7 into the T115-W, T125-W and T145-W Fireboxes.
Switches to pair with a Firebox
WatchGuard's range covers firewalls and access points, and WatchGuard's Network Management service monitors "firewalls, switches, access points, servers" across the network. For the switching itself, pair a Firebox with managed switches such as the Cisco Catalyst 1300, HPE Aruba Networking CX or HPE Networking Instant On for a small office. We can quote the firewall, switches and access points as one bill of materials.
Replacing an older Firebox
| Older model | WatchGuard end of sale | WatchGuard end of life | WatchGuard's migration path |
|---|---|---|---|
| Firebox T35 | 17 Jul 2021 | 31 Dec 2025 | T125 or T145 |
| Firebox T40 | 1 Jul 2023 | 1 Jul 2028 | T125 or T145 |
| Firebox T45 | 1 Apr 2025 | 1 Jul 2031 | T145 |
| Firebox T80 | 1 Jul 2023 | 1 Jul 2028 | T175 or T185 |
| Firebox M290 | 1 Aug 2026 | 1 Jul 2031 | M295 |
| Firebox M370 | 1 Jul 2023 | 1 Jul 2028 | M295 or M395 |
| Firebox M470 | 1 Jul 2023 | 1 Jul 2028 | M395 or M495 |
| Firebox M590 | 1 Jun 2026 | 1 Jul 2031 | M495 |
| Firebox M670 | 1 Jul 2023 | 1 Jul 2028 | M595 or M695 |
Dates and migration paths are from WatchGuard's end-of-life policy (opens in a new tab), which says "Product EOS dates will be up to five years prior to product EOL". Every older Firebox and access point is on WatchGuard end of life. We can quote the replacement with its suite and move your configuration across, with the scope confirmed at quote.
WatchGuard ranges we supply
| Range | Vendor | Models | Examples |
|---|---|---|---|
| WatchGuard Firebox tabletop appliances (T Series) | WatchGuard | 7 | Firebox T115-W, Firebox T125 , Firebox T145 , Firebox T175, Firebox T185, Firebox NV5 and more |
| WatchGuard Firebox rackmount appliances (M Series) | WatchGuard | 8 | Firebox M295, Firebox M395, Firebox M495, Firebox M595, Firebox M695, Firebox M4850 and more |
| WatchGuard secure access points (Wi-Fi 6 and Wi-Fi 7) | WatchGuard | 7 | AP130, AP230W, AP330, AP340, AP432, AP332CR and more |
Warranty and part numbers
WatchGuard states: "All WatchGuard hardware includes a one-year hardware warranty", and "An advance Hardware Warranty Replacement is available with an active Support subscription." Those are WatchGuard's terms (hardware warranty (opens in a new tab)); anything we add is confirmed at quote.
WatchGuard makes its ordering part numbers available to partners rather than on its public pages, so our model tables are listed by model name, and your quote gives the exact WatchGuard part number for each appliance, suite and term.
Virtual Fireboxes and comparisons
FireboxV and Firebox Cloud, WatchGuard's virtual firewalls, are covered on WatchGuard Firebox Cloud (opens in a new tab) on cloud-security.cloud. To compare WatchGuard with Fortinet and Cisco firewalls, see Fortinet vs WatchGuard and the small business firewall guide.
How to order WatchGuard
How ordering works. Press Add next to a part number and it goes into your basket; where the hardware needs a subscription or support term, you pick it in the same step. Add any accessories, then View basket and Request a quote. We check every line, quantity and term against your sites and come back with a personalised quote by email. Nothing is charged online. We can also design, supply, stage, install and configure the network as a project, with the scope confirmed at quote (see network installation).
Replacing an older Firebox? Contact us with the model you run and we will quote its WatchGuard migration path.
Explore WatchGuard
How we can help with your network
Forever Systems can design, supply, stage, install and configure the network around the hardware you buy here, as a project or one step at a time.
- Design: we look at your sites, users and existing kit and size the switches, wireless and firewalls to fit
- Supply: every order gets a personalised quote by part number, with the subscriptions and support each product needs
- Stage: we can pre-configure and label equipment before it reaches site
- Install: we can rack and mount switches, access points and firewalls on site
- Configure: VLANs, wireless, firewall policy, VPNs and management platforms set up and documented at handover
Scope is confirmed at quote, so you only pay for the parts of the project you need.
Frequently asked questions
What is a WatchGuard Firebox?
WatchGuard's range of firewall appliances: tabletop T Series for small offices and branches and rackmount M Series for larger sites, each running WatchGuard's Fireware with a support licence or security suite.
Which WatchGuard firewall is best for a small business?
Usually a T125 or T145 (with -W versions for built-in Wi-Fi 7), or the T175 or T185 for a busier office. For 100 users WatchGuard positions the M295. We can suggest one from your users and internet speed.
Do WatchGuard firewalls need a subscription?
Each Firebox is sold with Standard Support or a Basic, Prime or Total Security Suite, which also lets you manage it in WatchGuard Cloud. We quote the appliance and suite together.
What is the WatchGuard Prime Security Suite?
A suite between Basic and Total that adds APT Blocker, DNSWatch and Shadow AI. WatchGuard offers it on its models launched after 2025.
What replaced the WatchGuard M370 and T40?
WatchGuard names the M295 or M395 for the M370, and the T125 or T145 for the T40.
Can you install a WatchGuard firewall?
Yes. We can design, supply, stage, install and configure WatchGuard Fireboxes and access points, with the scope confirmed at quote.
Ready to order?
Build your basket and check out when you are ready.