WatchGuard Firebox T125, T145, T185 or M295: which model should you choose?

You have a WatchGuard quote in front of you, or an old Firebox to replace, and the question is simple: T125, T145, T185 or M295? Short answer: choose on the full-scan HTTPS throughput published by WatchGuard, compare it with your internet links and internal traffic, then check ports and Wi-Fi. The vendor’s user count is a good starting point, not a guarantee.

As an official WatchGuard partner in Morocco, we install these appliances for SMBs, branches and multi-site headquarters. This guide focuses on choosing a model in the current range. For configuration and day-to-day operation, see our complete Firebox guide for SMBs.

The current Firebox range in one table

All figures below are those published by WatchGuard on its official comparison tool. They are maximum lab values: your real throughput will be lower, which is why headroom matters.

Model	WatchGuard guidance	UTM (full scan)	HTTPS (full scan)	Firewall	Interfaces	Wi-Fi / PoE
Firebox T115-W	5 users	280 Mbps	140 Mbps	1.02 Gbps	3 x 1 GbE	Built-in Wi-Fi 7
Firebox T125 / T125-W	25 users	510 Mbps	270 Mbps	2.28 Gbps	1 x 2.5 GbE, 4 x 1 GbE	Wi-Fi 7 on T125-W
Firebox T145 / T145-W	50 users	710 Mbps	380 Mbps	3.9 Gbps	1 x 2.5 GbE, 4 x 1 GbE, 1 x SFP/SFP+	Wi-Fi 7 on T145-W
Firebox T185	100 users	1.83 Gbps	1 Gbps	7.9 Gbps	4 x 1 GbE, 4 x 2.5 GbE, 1 x SFP/SFP+	2 PoE+ ports, no Wi-Fi
Firebox M295	100 users	1.85 Gbps	1.12 Gbps	7.9 Gbps	4 x 2.5 GbE, 4 x 1 GbE, 2 x SFP+	Rack-mount, no Wi-Fi
Firebox M395	250 users	3 Gbps	1.9 Gbps	20 Gbps	12 x 2.5 GbE, 2 x SFP, 2 x SFP+	Rack-mount, no Wi-Fi

VPN capacity follows the same progression: 5 branch office tunnels and 5 mobile VPN users on the T115-W, 10 and 25 on the T125, 30 and 50 on the T145, 100 and 100 on the T185 and M295, 350 and 350 on the M395.

The figure to watch: HTTPS, not firewall

A T145 is rated at 3.9 Gbps as a firewall but 380 Mbps for full-scan HTTPS. That is not a contradiction: the first figure measures an appliance that simply allows or blocks connections, the second one that decrypts web traffic, scans it and re-encrypts it. Most web traffic is encrypted today. A Firebox that does not inspect HTTPS lets most of what enters the company through blind.

Our rule is simple: HTTPS throughput must cover your main internet link, and UTM throughput the sum of your links plus the traffic flowing between your internal networks. If you plan to turn off HTTPS inspection to “gain speed”, you are buying a firewall not to use it.

Model by model: who it is for

Firebox T115-W: the micro office

Three gigabit ports, built-in Wi-Fi 7, five users as guidance. It suits a freelancer, a small practice or an isolated shop. Note that WatchGuard states Access Portal and IntelligentAV are not available on this model. As soon as you go beyond a few workstations or have a server to protect, move up to the T125.

Firebox T125: the branch and small office

Up to 25 users, one 2.5 GbE port and four gigabit ports, with a Wi-Fi 7 version. It is the right choice for a branch connected to a headquarters, a shop or a practice of around fifteen people on a fiber link of a few hundred megabits. Its 270 Mbps HTTPS throughput becomes the limit if your fiber is faster.

Firebox T145: the typical SMB

Up to 50 users, with an SFP/SFP+ port to connect a fiber or a 10 Gbps switch, and an optional rack-mount kit. This is the model we propose most often for an SMB of 20 to 40 people with remote work. If you have several internet links or heavy internal traffic between segmented networks, look straight at the T185.

Firebox T185: the top of the desktop range

Up to 100 users, four 2.5 GbE ports including two PoE+ (802.3at) ports to power an access point or small device, one SFP/SFP+ port and an optional rack-mount kit. It has no Wi-Fi and has a fan: plan to put it in a technical room rather than on a desk.

Firebox M295 and M395: headquarters

The M295 targets the same 100-user guidance as the T185, but in a rack-mount format with two SFP+ ports. The M395 goes up to 250 users, with twelve 2.5 GbE ports and four fiber slots. These are the models that carry the VPN tunnels of a branch network and the traffic between many internal networks.

T185 or M295: how to decide

Criterion	Firebox T185	Firebox M295
Format	Desktop, optional rack kit	Rack-mount
UTM / HTTPS	1.83 Gbps / 1 Gbps	1.85 Gbps / 1.12 Gbps
VPN (IMIX)	1.14 Gbps	1.8 Gbps
Fiber	1 x SFP/SFP+	2 x SFP+
PoE	2 PoE+ ports	No
For whom	Large branch, SMB without a proper rack	Headquarters with a rack, multi-site, busy VPNs

If you have a real rack, two fiber links or a headquarters concentrating many tunnels, the M295 is the more consistent choice. For a large branch or an SMB without a server room, the T185 does the same job in a simpler format.

Replacing a T25, T45, T85 or M290?

The previous generation is still widely installed. Do not replace a model with its numerical “equivalent” without comparing published figures: a T85 is rated at 943 Mbps UTM and 576 Mbps HTTPS, above a T145. Depending on your traffic, the logical successor to a T85 may therefore be a T185. Likewise, an M290 is rated for 75 users and 1,180 Mbps UTM, an M295 for 100 users and 1.85 Gbps. We always start from the traffic measured on the old appliance to choose the new one.

Licences: the appliance is not everything

WatchGuard offers three subscription levels:

• Standard Support: firewall, VPN, SD-WAN and Access Portal, with standard 24x7 support. No security services.
• Basic Security Suite: adds intrusion prevention, gateway antivirus, WebBlocker, spamBlocker, application control, Reputation Enabled Defense and Network Discovery. Logs kept for 90 days in WatchGuard Cloud.
• Total Security Suite: adds APT Blocker, DNSWatch, IntelligentAV, ThreatSync XDR and EDR Core, Gold 24x7 support, and 365 days of logs.

For an SMB, Total Security Suite is our default recommendation. We always compare quotes over the full subscription term, hardware and licences together, and record the renewal date.

Our method in five steps

1. Count users, devices and remote workers, with growth headroom.
2. Measure the real throughput of your links and the traffic between internal networks, on the old appliance if possible.
3. Choose the model whose HTTPS throughput covers the main link and whose UTM throughput covers total traffic.
4. Check connectivity: 2.5 GbE ports, SFP+, PoE, built-in Wi-Fi or dedicated access points.
5. Pair it with the right security suite and schedule the cut-over outside business hours.

The most common mistakes

1. Choosing on firewall throughput, then turning off HTTPS inspection because the appliance saturates.
2. Buying a T115-W for a team of fifteen because it has Wi-Fi.
3. Replacing a T85 with a T145 without comparing published figures.
4. Forgetting internal traffic: backups and server access also go through the Firebox.
5. Buying the appliance with Standard Support only, without any security service.

Checklist before ordering

• WatchGuard user guidance respected, growth headroom included.
• HTTPS throughput above your main link, UTM throughput above total traffic.
• Number of branch office and mobile VPN tunnels compatible with the model.
• Ports listed: SFP+ fiber, 2.5 GbE, PoE, 4G backup.
• Built-in Wi-Fi relevant, or dedicated access points planned.
• Security suite chosen and renewal date recorded.
• Right format: desktop, rack kit or rack-mount.

How we do it

We start with a free audit of your network and real traffic. We then propose a model and licence justified by your figures, and handle configuration (segmentation, HTTPS inspection, VPN with AuthPoint MFA), the cut-over outside production hours and connection to our 24/7 monitoring, with critical alerts handled in under 15 minutes. This deployment is part of our business cybersecurity offering.

Still torn between WatchGuard and Fortinet? Read our comparison FortiGate or WatchGuard for an SMB, our business firewall buying guide for Morocco and the Fortinet equivalent, which FortiGate to choose. Anonymised examples are available in our case studies.

To choose your Firebox based on your real traffic, request your free audit: we reply within 24 business hours.