WatchGuard Firebox T125-W.
Wired and wireless. One appliance. No separate AP license.
The T125-W delivers the same 510 Mbps UTM throughput and five-port layout as the wired T125, with Wi-Fi 7
added through built-in dual-band radios and external antennas. Retail locations, small offices, and branch
sites where running cable to every desk is not practical get full firewall protection and wireless access
from a single appliance under a single WatchGuard Cloud policy.
1x 2.5Gb Ethernet WAN port and 4x 1Gb Ethernet LAN ports (5 wired ports total). Built-in Wi-Fi 7
(802.11be) with dual-band external SMA antennas for greater throughput and range than internal antenna
designs. 1 Serial port and 2 USB-A 3.2 ports. 5 EDR Core sensors included. Unrestricted VLANs for
network segmentation.
VPN and SD-WAN
10 Branch Office VPN (site-to-site) tunnels. 10 Mobile VPN connections. Site-to-site VPN over IKEv2,
IPSec, policy and route-based tunnels, and TLS hub and spoke. Remote access over IKEv2, IPSec, L2TP, and
TLS. SD-WAN with multi-WAN failover, dynamic path selection, and jitter, loss, and latency measurement.
Active/passive and active/active high availability clustering.
Security Services
Stateful packet inspection, TLS decryption, and proxy firewall. Basic Security Suite includes IPS,
Gateway AV, Application Control, WebBlocker, spamBlocker, and Reputation Enabled Defense. Total Security
Suite adds APT Blocker, IntelligentAV, DNSWatch, ThreatSync (XDR), and EDR Core. Over 100 dashboards and
reports in WatchGuard Cloud, including PCI and HIPAA compliance.
T125-W vs. T125 or T145-W?
The T125-W sits between the wired T125 and the higher-capacity T145-W in the lineup. See how UTM
throughput, VPN tunnels, and port counts stack up across the full T Series on the series comparison page.
The T125-W integrates the firewall and wireless radio under a single WatchGuard Cloud
policy and management console. You avoid paying a separate AP license, and there is no second device
to deploy, configure, or renew. For small offices where one or two coverage zones is enough, the
T125-W is cleaner and less expensive than pairing a wired T125 with a standalone AP.
The T125-W uses Wi-Fi 7 (802.11be) with dual-band external SMA antennas. Wi-Fi 7
supports higher aggregate throughput and lower latency compared to Wi-Fi 6 and 6E, and the external
antennas give you more flexibility in placing the appliance for better coverage than internal antenna
designs would allow in a compact tabletop unit.
WatchGuard rates the T125-W for up to 40 users, counting both wired and wireless
clients. If your site grows past 40 users or you need separate coverage zones, consider pairing a
T145-W with dedicated WatchGuard AP hardware managed through the same WatchGuard Cloud account, giving
you more throughput capacity and more wireless coverage flexibility.
Yes. Site-to-site VPN over IKEv2, IPSec, and TLS, plus mobile VPN over IKEv2, IPSec,
L2TP, and TLS are all supported, identical to the wired T125. The T125-W supports 10 Branch Office VPN
tunnels and 10 Mobile VPN connections. Adding wireless to the appliance does not reduce any of the VPN
or firewall capabilities.
Yes. The T125-W supports unrestricted VLANs, letting you put wireless clients on a
separate guest or IoT VLAN from wired corporate traffic. Each VLAN gets its own policy and firewall
rules, so a device on the guest wireless network cannot reach wired corporate resources without
explicit permission in your ruleset.
Not sure the T125-W is the right fit?
Tell us your user count, ISP speed, and how many wireless coverage zones you need. A certified WatchGuard
engineer at Firewalls.com will tell you whether the T125-W covers it or whether separate AP hardware makes
more sense for your site.
