The T125 is the wired-only model with five Ethernet ports and a 2.5Gb WAN port. The T125-W adds built-in Wi-Fi 7 with external dual-band antennas. Both share identical throughput specs (510 Mbps UTM, 2.28 Gbps firewall) and support 10 Branch Office VPN tunnels. If your site needs wireless, the T125-W keeps everything under one appliance and one WatchGuard Cloud policy.

WatchGuard sizes the T125 for up to 40 users. Actual capacity depends on your ISP speed, which security services you run, and your traffic mix. Offices that are approaching 40 users, have a faster ISP circuit, or run deep inspection on all HTTPS traffic may want to look at the T145, which delivers 710 Mbps UTM throughput and supports up to 75 users.

Yes. The T125 includes full SD-WAN with multi-WAN failover, dynamic path selection, and jitter, loss, and latency measurement. You can add a second ISP or LTE backup connection and the T125 will route traffic automatically to the best path and fail over to the secondary when the primary degrades, without any manual intervention.

IntelligentAV is available on the T125 with a Total Security Suite subscription. It adds AI-powered malware detection alongside the gateway antivirus and APT Blocker cloud sandbox already included in Total Security. The Basic Security Suite does not include IntelligentAV, though it does include gateway antivirus for signature-based protection.

Yes. WatchGuard Cloud provides centralized policy management, monitoring, and reporting across all your Firebox appliances regardless of location. Templates let you push consistent configuration changes to a fleet of T125 units at once. Zero-touch deployment also lets you provision new units from Cloud before shipping them to a branch, so they come online automatically without a site visit.