Sub-Total: $0.00
WatchGuard Firebox Firewalls, Sized and Priced by the Month
Eleven Firebox models, from a five-person office to a 7,500-user headquarters. Every monthly price includes WatchGuard's Total Security Suite, so intrusion prevention, gateway antivirus, APT Blocker, DNSWatch, and threat detection are part of the price instead of a renewal surprise at year two.
Start here
How Many People Are Behind the Firewall?
Count every user and device that browses through the site: staff, guest Wi-Fi, and cloud-connected equipment. We'll match the smallest model rated for that load.
Over 1,000 users? Type the number in the box. Sizing also depends on your internet speed: a 1 Gbps circuit needs a model whose full-scan UTM throughput can keep up. We confirm both before quoting.
RECOMMENDED MODEL
Firebox T185
$349.00 / month with Total Security Suite
Rated for100 users
UTM (full scan)1.83 Gbps
Branch VPN tunnels100
The lineup
Every Firebox Model, Side by Side
T-Series tabletop models cover small and branch offices. M-Series rack-mount appliances take over from 75 users up, with modular interface bays for fiber and 10 Gb connections.
T-Series: small & branch offices
Firebox T115-W
Ideal for up to 5 users
Wi-Fi 7
$139.00 / month
- UTM (full scan) 280 Mbps
- Firewall 1.02 Gbps
- VPN 640 Mbps
- Branch VPN tunnels 5
Ports: 3 × 1 Gb
Firebox T125
Ideal for up to 25 users
Tabletop
$149.00 / month
- UTM (full scan) 510 Mbps
- Firewall 2.28 Gbps
- VPN 1.44 Gbps
- Branch VPN tunnels 10
Ports: 1 × 2.5 Gb, 4 × 1 Gb
Firebox T145
Ideal for up to 50 users
Tabletop
$199.00 / month
- UTM (full scan) 710 Mbps
- Firewall 3.9 Gbps
- VPN 1.94 Gbps
- Branch VPN tunnels 30
Ports: 1 × 2.5 Gb, 4 × 1 Gb, 1 × SFP/SFP+
Firebox T85
Ideal for up to 50 users
LTE option
$259.00 / month
- UTM (full scan) 943 Mbps
- Firewall 4.96 Gbps
- VPN 2.04 Gbps
- Branch VPN tunnels 60
Ports: 8 × 1 Gb; optional 1 × SFP+ or 4G/LTE
Firebox T185
Ideal for up to 100 users
Tabletop
$349.00 / month
- UTM (full scan) 1.83 Gbps
- Firewall 7.9 Gbps
- VPN 5.8 Gbps
- Branch VPN tunnels 100
Ports: 4 × 1 Gb, 4 × 2.5 Gb, 1 × SFP/SFP+
M-Series: mid-size to enterprise
Firebox M295
Ideal for up to 75 users
Rack-mount
$339.00 / month
- UTM (full scan) 1.18 Gbps
- Firewall 5.8 Gbps
- VPN 2.4 Gbps
- Branch VPN tunnels 75
Ports: 8 × 1 Gb copper; optional modules: 1 Gb copper/fiber, 10 Gb SFP+, 5 Gb multispeed
Firebox M390
Ideal for up to 250 users
Rack-mount
$449.00 / month
- UTM (full scan) 2.4 Gbps
- Firewall 18 Gbps
- VPN 5.2 Gbps
- Branch VPN tunnels 250
Ports: 8 × 1 Gb copper; optional modules: 1 Gb copper/fiber, 10 Gb SFP+, 5 Gb multispeed
Firebox M590
Ideal for up to 500 users
Rack-mount
$889.00 / month
- UTM (full scan) 3.3 Gbps
- Firewall 20 Gbps
- VPN 6.84 Gbps
- Branch VPN tunnels 500
Ports: 8 × 1 Gb copper, 2 × 10 Gb SFP+; optional modules incl. 5 Gb multispeed PoE+
Firebox M690
Ideal for up to 850 users
Rack-mount
$1,439.00 / month
- UTM (full scan) 4.6 Gbps
- Firewall 29.7 Gbps
- VPN 10.0 Gbps
- Branch VPN tunnels 1,000
Ports: 8 × 1 Gb, 2 × 10 Gb SFP+, 2 × 10 Gb multispeed; optional modules incl. PoE+
Firebox M4800
Ideal for up to 2,500 users
Rack-mount
$1,999.00 / month
- UTM (full scan) 6.8 Gbps
- Firewall 49.6 Gbps
- VPN 16.4 Gbps
- Branch VPN tunnels 5,000
Ports: 8 × 1 Gb included; optional 8 × 1 Gb, 8 × 1 Gb fiber, 4 × 10 Gb fiber, 2 × 40 Gb fiber
Firebox M5800
Ideal for up to 7,500 users
Rack-mount
$4,950.00 / month
- UTM (full scan) 11.3 Gbps
- Firewall 87 Gbps
- VPN 18.8 Gbps
- Branch VPN tunnels Unrestricted
Ports: 8 × 1 Gb, 4 × 10 Gb fiber included; optional 8 × 1 Gb, 8 × 1 Gb fiber, 4 × 10 Gb fiber, 2 × 40 Gb fiber
Full Spec Comparison
Scroll sideways to see all eleven models. The model column stays pinned on the left.
| Monthly price (Total Security Suite) | $139.00 | $149.00 | $199.00 | $259.00 | $339.00 | $349.00 | $449.00 | $889.00 | $1,439.00 | $1,999.00 | $4,950.00 |
| Ideal for | 5 users | 25 users | 50 users | 50 users | 75 users | 100 users | 250 users | 500 users | 850 users | 2,500 users | 7,500 users |
| Performance | |||||||||||
| UTM (full scan) | 280 Mbps | 510 Mbps | 710 Mbps | 943 Mbps | 1.18 Gbps | 1.83 Gbps | 2.4 Gbps | 3.3 Gbps | 4.6 Gbps | 6.8 Gbps | 11.3 Gbps |
| Firewall (UDP 1518) | 1.02 Gbps | 2.28 Gbps | 3.9 Gbps | 4.96 Gbps | 5.8 Gbps | 7.9 Gbps | 18 Gbps | 20 Gbps | 29.7 Gbps | 49.6 Gbps | 87 Gbps |
| VPN (UDP 1518) | 640 Mbps | 1.44 Gbps | 1.94 Gbps | 2.04 Gbps | 2.4 Gbps | 5.8 Gbps | 5.2 Gbps | 6.84 Gbps | 10.0 Gbps | 16.4 Gbps | 18.8 Gbps |
| VPN (IMIX) | 210 Mbps | 480 Mbps | 680 Mbps | 680 Mbps | 800 Mbps | 1.14 Gbps | 1.8 Gbps | 2.2 Gbps | 3.2 Gbps | 4.8 Gbps | 5.2 Gbps |
| AntiVirus | 450 Mbps | 880 Mbps | 1.06 Gbps | 1.53 Gbps | 1.47 Gbps | 3 Gbps | 3.1 Gbps | 5.0 Gbps | 6.2 Gbps | 12.5 Gbps | 22 Gbps |
| IPS (full scan) | 375 Mbps | 725 Mbps | 1.03 Gbps | 1.28 Gbps | 1.3 Gbps | 2.41 Gbps | 3.3 Gbps | 4.6 Gbps | 5.8 Gbps | 8.1 Gbps | 12.5 Gbps |
| HTTPS (full scan) | 140 Mbps | 270 Mbps | 380 Mbps | 576 Mbps | 696 Mbps | 1 Gbps | 1.32 Gbps | 1.9 Gbps | 2.9 Gbps | 4.2 Gbps | 4.9 Gbps |
| VPN tunnels | |||||||||||
| Branch office VPN | 5 | 10 | 30 | 60 | 70 | 100 | 250 | 500 | 1000 | 5000 | Unrestricted |
| Mobile VPN | 5 | 25 | 50 | 60 | 75 | 100 | 250 | 500 | 1000 | 10,000 | Unrestricted |
| Hardware & networking | |||||||||||
| Interfaces & modules | 3 × 1 Gb | 1 × 2.5 Gb, 4 × 1 Gb | 1 × 2.5 Gb, 4 × 1 Gb, 1 × SFP/SFP+ | 8 × 1 Gb; optional 1 × SFP+ or 4G/LTE | 8 × 1 Gb copper; optional modules: 1 Gb copper/fiber, 10 Gb SFP+, 5 Gb multispeed | 4 × 1 Gb, 4 × 2.5 Gb, 1 × SFP/SFP+ | 8 × 1 Gb copper; optional modules: 1 Gb copper/fiber, 10 Gb SFP+, 5 Gb multispeed | 8 × 1 Gb copper, 2 × 10 Gb SFP+; optional modules incl. 5 Gb multispeed PoE+ | 8 × 1 Gb, 2 × 10 Gb SFP+, 2 × 10 Gb multispeed; optional modules incl. PoE+ | 8 × 1 Gb included; optional 8 × 1 Gb, 8 × 1 Gb fiber, 4 × 10 Gb fiber, 2 × 40 Gb fiber | 8 × 1 Gb, 4 × 10 Gb fiber included; optional 8 × 1 Gb, 8 × 1 Gb fiber, 4 × 10 Gb fiber, 2 × 40 Gb fiber |
| Wireless | Wi-Fi 7 built in | T125-W: Wi-Fi 7 | T145-W: Wi-Fi 7 | N/A | N/A | N/A | N/A | N/A | N/A | N/A | N/A |
| VLANs | Unrestricted | Unrestricted | Unrestricted | 75 | 100 | Unrestricted | 250 | 750 | 1,000 | 1,000 | Unrestricted |
| SD-WAN dynamic path selection |
|
|
|
|
|
|
|
|
|
|
|
| Security services (all included) | |||||||||||
| Stateful firewall, VPN, SD-WAN |
|
|
|
|
|
|
|
|
|
|
|
| Access Portal* | N/A |
|
|
|
|
|
|
|
|
|
|
| Basic Security Suite (IPS, GAV, App Control, WebBlocker, spamBlocker, RED, Network Discovery) |
|
|
|
|
|
|
|
|
|
|
|
| APT Blocker, DNSWatch, Threat Detection & Response |
|
|
|
|
|
|
|
|
|
|
|
| IntelligentAV | N/A |
|
|
|
|
|
|
|
|
|
|
* Access Portal is included in the Support License tier. Throughput figures are WatchGuard-published maximums under test conditions. Real-world throughput depends on the traffic mix and which services are enabled.
Per-user add-ons
Add-on security licenses
Billed per user, per month. Add them to a Firebox order or buy them on their own.
| WatchGuard EPP | $10.56 |
| WatchGuard EDR | $9.92 |
| WatchGuard EPDR | $12.20 |
| AuthPoint Multi-Factor Authentication | $7.80 |
| DNSWatch GO | $10.08 |
| Passport | $26.84 |
| Total Identity Security | $15.04 |
| WatchGuard Patch Management | $6.24 |
| WatchGuard Full Encryption | $4.68 |
| FireCloud Internet Access | $22.84 |
| ThreatSync + NDR | $19.08 |
| ThreatSync + SaaS | $8.40 |
| Compliance Reporting | $7.00 |
| WatchGuard Managed Detection & Response | $12.20 |
| WatchGuard Total MDR | $26.56 |
| WatchGuard Core MDR for Microsoft | $20.88 |
| WatchGuard Total XDR | $27.68 |
The Firebox protects the network edge. These licenses extend the same WatchGuard Cloud console to endpoints, identities, and SaaS apps, so alerts from the firewall and the laptop correlate in one place.
Common pairings: a Firebox with EPDR for endpoints and AuthPoint MFA for logins covers most cyber-insurance questionnaires. Add Total MDR if you want WatchGuard analysts watching alerts around the clock. See the endpoint platforms on the Cybersecurity Products & Services page.
Before You Order
Size to the circuit, not just headcount
A 25-user office on a 1 Gbps fiber line can outrun a T125's full-scan throughput. Tell us your internet speed and we'll size to whichever limit you hit first.
Multi-site means one per site
Each location gets its own Firebox, tied together over branch-office VPN and SD-WAN. Check the tunnel count on the hub model if you're connecting many branches.
Replacing another firewall?
We migrate existing rules, VPNs, and port forwards during install, and schedule the cutover outside business hours.
Pricing moves
Prices shown are current as of September 2026 and can change with WatchGuard's price list. Your written quote locks the price.
Get a Firebox Quote for Your Site
Tell us your user count, internet speed, and how many locations need protecting. We'll confirm the model, add any licenses you want, and quote installation as one request.