WatchGuard Firebox T125.
Five ports. Multi-gig WAN. More throughput for more traffic.
The Firebox T125 is the go-to T Series model for small businesses and retail locations that have outgrown a
basic router but do not need rack hardware yet. One 2.5Gb WAN port and four 1Gb LAN ports give you room to
segment your network without a separate switch, and 510 Mbps UTM throughput means security services run
without choking daily traffic.
1x 2.5Gb Ethernet WAN port and 4x 1Gb Ethernet LAN ports (5 total). 1 Serial port and 2 USB-A 3.2
ports. Unrestricted VLAN support for network segmentation. 5 EDR Core sensors included. Dynamic routing
via RIP, OSPF, and BGP. Link aggregation with 802.3ad dynamic, static, and active/backup modes.
VPN and SD-WAN
10 Branch Office VPN (site-to-site) tunnels. 10 Mobile VPN connections. Site-to-site VPN over IKEv2,
IPSec, policy and route-based tunnels, and TLS hub and spoke. Remote access over IKEv2, IPSec, L2TP, and
TLS. SD-WAN with multi-WAN failover, dynamic path selection, and jitter, loss, and latency measurement.
Active/passive and active/active HA clustering.
Security Services
Stateful packet inspection, TLS decryption, and proxy firewall. Basic Security Suite includes IPS,
Gateway AV, Application Control, WebBlocker, spamBlocker, and Reputation Enabled Defense. Total Security
Suite adds APT Blocker, IntelligentAV, DNSWatch, ThreatSync (XDR), and EDR Core. Over 100 dashboards and
reports available in WatchGuard Cloud, including PCI and HIPAA compliance reports.
Comparing T125 to other T Series models?
The T125 is the most popular T Series choice for small business. See how it stacks up against the
wireless T125-W and the higher-capacity T145 on the full series comparison page.
The T125 is the wired-only model with five Ethernet ports and a 2.5Gb WAN port. The
T125-W adds built-in Wi-Fi 7 with external dual-band antennas. Both share identical throughput specs
(510 Mbps UTM, 2.28 Gbps firewall) and support 10 Branch Office VPN tunnels. If your site needs
wireless, the T125-W keeps everything under one appliance and one WatchGuard Cloud policy.
WatchGuard sizes the T125 for up to 40 users. Actual capacity depends on your ISP
speed, which security services you run, and your traffic mix. Offices that are approaching 40 users,
have a faster ISP circuit, or run deep inspection on all HTTPS traffic may want to look at the T145,
which delivers 710 Mbps UTM throughput and supports up to 75 users.
Yes. The T125 includes full SD-WAN with multi-WAN failover, dynamic path selection,
and jitter, loss, and latency measurement. You can add a second ISP or LTE backup connection and the
T125 will route traffic automatically to the best path and fail over to the secondary when the primary
degrades, without any manual intervention.
IntelligentAV is available on the T125 with a Total Security Suite subscription. It
adds AI-powered malware detection alongside the gateway antivirus and APT Blocker cloud sandbox
already included in Total Security. The Basic Security Suite does not include IntelligentAV, though it
does include gateway antivirus for signature-based protection.
Yes. WatchGuard Cloud provides centralized policy management, monitoring, and
reporting across all your Firebox appliances regardless of location. Templates let you push consistent
configuration changes to a fleet of T125 units at once. Zero-touch deployment also lets you provision
new units from Cloud before shipping them to a branch, so they come online automatically without a
site visit.
Not sure the T125 is the right size?
Tell us your user count, ISP speed, and whether you need wireless. A certified WatchGuard engineer at
Firewalls.com will size the right model and security suite for your site before you buy, at no cost.
Login and Registration Form
Existing User