WatchGuard® Network Security Products at a Glance
Firebox
NV5Firebox
T25 /T25-W

Firebox
T35-R*

FireboxT45 /T45-W

Firebox
T85

Firebox
M290

Firebox
M390

Firebox
M590

Firebox
M690

Firebox
M4800

Firebox
M5800

User Counts (recommended)

5520

20

50

60

150

600

850

1500

7500

Firewall (UDP 1518)

N/A

3.14 Gbps

940 Mbps

3.94 Gbps

4.96 Gbps

5.8 Gbps

18.0 Gbps

20.0 Gbps

29.7 Gbps

49.6 Gbps

87.0 Gbps

200 Mbps

1.02 Gbps

560 Mbps

1.58 Gbps

2.04 Gbps

2.4 Gbps

5.2 Gbps

6.84 Gbps

10.0 Gbps

16.4 Gbps

18.8 Gbps

AntiVirus

N/A472 Mbps

325 Mbps

874 Mbps

1.53 Gbps

1.47 Gbps

3.1 Gbps

5.0 Gbps

6.2 Gbps

12.5 Gbps

22.0 Gbps

IPS (Full Scan)

N/A

525 Mbps

300 Mbps

716 Mbps

1.28 Gbps

1.3 Gbps

3.3 Gbps

4.6 Gbps

5.8 Gbps

8.1 Gbps

12.5 Gbps

UTM (Full Scan)

N/A

403 Mbps

203 Mbps

557 Mbps

943 Mbps

1.18 Gbps

2.4 Gbps

3.3 Gbps

4.6 Gbps

6.8 Gbps

11.3 Gbps

8¶

8¶

8¶

8¶

8 x 1 Gb
(additional ports available¶)

8 x 1 Gb + 4 x 10 Gb fiber(additional ports available¶)

THROUGHPUT AND CONNECTIONSVPN (UDP 1518)

3 x 1Gb

5 x 1Gb

5 x 1 Gb

5§ x 1 Gb

8 x 1 Gb,
Optional 1 x SFP+ §EDR Core Licenses

N/A

520205075

150250

250

250

250

Concurrent connections

73,0001,300,000

1,300,000

3,850,000

3,850,000

3,500,000

4,500,000

6,000,000

15,000,000

15,000,000

30,800,000

New connections per second

8,500

16,0006,800

26,50035,50034,00098,000132,000

146,000

254,000

328,000

VLAN support

1010505075

100

250

750

1,000

1,000

Unrestricted

Branch Office VPN

101025306075

250

500

1,000

5,000

Unrestricted

Mobile VPN IPSec

101025306075250

500

1,000

10,000UnrestrictedInterfaces

VPN TUNNELSWIRELESS

1Wireless Access Points (APs)

WatchGuard offers a family of AP devices that allow all Firebox security capabilities to be extended to the WLAN. APs can be managed in the Wi-Fi Cloud or through the Firebox’s built-in wireless controller. For managing more than 20 APs, WatchGuard recommends Wi-Fi Cloud. More info at watchguard.com/wifi

Max APs advised per model
Integrated Wireless04202020202020202020

Integrated 802.11ax is available for Firebox T25-W and T45-W-POE; Integrated 802.11ax and 5G cellular available with T45-CW

OPERATING SYSTEM FEATURES
Advanced Networking

Dynamic routing (BGP, OSPF, RIPv1,2) / SD-WAN dynamic path selection / NAT: static, dynamic, 1:1, IPSec traversal, policy-based PAT / Traffic shaping & QoS: 8 priority queues, DiffServ, modified strict queuing / Virtual IP for server load balancing

Availability

High availability –active/passive, and active/active for clustering / VPN failover / Multi-WAN failover / Multi-WAN load balancing / Link aggregation (802.3ad dynamic, static, active/backup)†SECURITY SERVICES
Basic Security Suite

Standard Support Only

Application Control / Intrusion Prevention Service / WebBlocker / Gateway AntiVirus / Reputation Enabled Defense / Network Discovery / spamBlocker / Standard Support (24 x 7)

Total Security Suite

Standard Support Only

Application Control / Intrusion Prevention Service / WebBlocker / Gateway AntiVirus / Reputation Enabled Defense / Network Discovery / spamBlocker / APT Blocker / DNSWatch / IntelligentAV / ThreatSync / EDR Core / Gold Support (24 x 7, plus escalated response time)* Firebox T35-R is a rugged, IP64-rated device designed for harsh environment.
§Power Over Ethernet (PoE) options: Firebox T45-PoE (1) and T85 (2) include built-in PoE+ ports.
¶
Firebox M290, M390, M590, and M690 ship with one empty bay that can accommodate one of the following: 8 x 1 Gb copper, 4 x 1 Gb copper, 4 x SFP fiber, 2 x SFP+ fiber, 4 x 1/2.5/5 Gb multi-speed ports. PoE+ not supported on M290 and M390.
Firebox M4800 and M5800 throughput rates are determined using base configuration + 4 x 10 Gb ports. Both models ship with two empty bays that can accommodate any combination of the following: 4 x 10 Gb fiber, 8 x 1 Gb fiber, 8 x 1 Gb copper, 2 x 40 Gb fiber.
1Use the Gateway Wireless Controller (GWC) to manage up to the advised number of APs in environments with low client density and little interference. A Secure Wi-Fi or Total Wi-Fi license is recommended for more demanding environments. Not available on NV5.
†Active/ Active clustering not available on wireless models or NV5. Link aggregation not available on NV5.
Throughput rates are determined using multiple flows through multiple ports and will vary depending on environment and configuration. Max firewall throughput tested using 1518 byte UDP packets based on RFC 2544 methodology. Contact your WatchGuard reseller or call WatchGuard directly (1.800.734.9905) for help determining the right model for your network.
Visit www.watchguard.com/sizing for online assistance.

Every Watchguard Appliance Includes These Features:
Security Capabilities• Stateful packet firewall, deep application inspection, application
proxies: HTTP, HTTPS, FTP, DNS, TCP/UDP, POP3, POP3S, SMTP,IMAPS, Explicit ProxyLogging & Reportingwith WatchGuard Cloud• Real-time multi-appliance log aggregation and reporting• Blocks spyware, DoS attacks, fragmented packets,malformed packets, blended threats and more

• Public & private Cloud-ready• Protocol anomaly detection, behavior analysis,pattern matching• Spot trends, outliers and insights about network traffic and usage• Static and dynamic blocked sources list
• VoIP: H.323 and SIP, call setup and session security• Visibility at a glance with intuitive and interactive visualizations• Over 100 reports including reports for PCI and HIPAA compliance• Option to deliver reports (PDF, CSV) via email• Anonymization to comply with privacy directives

Management Software

User Authentication

Support and Maintenance Options

WatchGuard appliances can be managed with any of the following:• Transparent Active Directory Authentication (single sign-on)• WatchGuard Cloud for centralized real-time management ofmultiple appliances via the Cloud• RADIUS, LDAP, Windows Active Directory, VASCO, RSA SecurID®,
internal database, SAML 2.0, SMS Passcode• Standard Support, included in the Basic Security Suite, includes
hardware warranty, 24 x 7 technical support, and softwareupdates• Web UI for managing single appliance via web browser• RSA SecurID® and VASCO• WatchGuard System Manager for intuitive management ofappliances via Windows client• Local database• Command line interface (CLI) for direct access via scripting• Microsoft® Terminal Services and Citrix XenAppenvironments supported• 802.1X for wireless appliances• An upgrade to Gold Support, included in the Total Security Suite,
delivers all the benefits of Standard Support, plus escalated
response times• For more information on WatchGuard’s Support levels andadditional service options, visit www.watchguard.com/support

No express or implied warranties are provided for herein. All specifications are subject to change and expected future products, features or functionality will be provided on an if and when available basis. ©2023 WatchGuard Technologies, Inc. All rights reserved. WatchGuard, the WatchGuard logo, WatchGuard Dimension, DNSWatch, IntelligentAV, Unified Security Platform and Firebox are trademarks
or registered trademarks of WatchGuard Technologies, Inc. in the United States and/or other countries. All other tradenames are the property of their respective owners. Part No. WGCE66683_060123