Skip to main content
Cisco Meraki Documentation

Meraki MX/Z Security and SD-WAN Licensing

Overview 

The Meraki MX security appliance is a multi-functional security & SD-WAN enterprise appliance with a wide set of capabilities to address multiple use cases for organizations of all sizes, in all industries.

Given the range of use cases that can be solved, there are three license options for the MX security appliance that provides customers the flexibility to select the license most appropriate for their intended use.

Enterprise

Advanced Security

Secure SD-WAN Plus

“All I require is Auto VPN and a firewall” “I connect directly to the Internet so need a UTM too” “My business is reliant on SaaS/IaaS/DC served apps”
  • Advanced analytics with machine learning powered by Meraki Insight

  • Internet intelligence from ThousandEyes 

  • Internet outages from ThousandEyes

The licensing structure for MX security appliances is the same as that of any other Meraki device – 1:1 ratio of devices to licenses. Pair your chosen MX appliance(s) with the relevant license for your use case:

  • Enterprise license

OR

  • Advanced security license

OR

  • Secure SD-WAN Plus license (Org-Wide and Per Device)

 

Note: If you wish to use subscription licensing, please refer to the MX and Z subscription articles for all the details. At this time, subscription and co-termination licenses can not be mixed in the same dashboard organization.

Note: The following feature breakdown is from the latest stable release. For the latest firmware release and its features, please refer the features directory documentation.  

For API support, please refer to the API documentation

 

Feature

Enterprise 

Advanced Security

Secure SD-WAN Plus 

Centralized management

Zero-touch firmware updates (including security patches)

True zero-touch provisioning

24x7 enterprise support

Open APIs

Automatic WAN failover

Uplink Load Balancing/Failover conditions

Sub-second dynamic path selection

3G / 4G cellular failover

High Availability 

Essential SD-WAN

SD-WAN Over Cellular

Sub-second Site-to-Site VPN failover

Site-to-site VPN (Auto VPN and 3rd party peering)

IPv6 Support

MPLS to VPN Failover

SD-WAN Steering and Policies

Traffic shaping/prioritization

Client VPN

Policy-Based Routing

VLAN to VLAN routing

Source-Based Routing

Local Breakout (IP and Port based)

Advanced Routing

Client connectivity alerts

Security Appliance alerts

Splash pages

Dual+ WAN functionality (pending release) 

Wireless and/or Cellular functionality 

Cloud Integrations

Group Policies

Configuration templates

Stateful firewall

Next-gen Traffic Analytics Engine - Network-Based Application Recognition (NBAR) Integration

Layer 7 (Application) Enforcement powered by NBAR

Enhanced Live Firewall Logging and Troubleshooting 

Traffic Shaping Enforcement powered by NBAR

Geography based firewall rules

 

Trusted Traffic Exclusions powered by NBAR  

Intrusion Detection and Prevention System (IDS/IPS)

 

Content Filtering powered by Talos Intelligence

 

YouTube Content Restriction

 

Web Search Filtering

 

Cisco Advanced Malware Protection (AMP)

 

Umbrella DNS Integration**

 

Cisco Secure Malware Analytics Integration (foremely know as Threat Grid)**

 

ThousandEyes Agent Integration**

 

Adaptive Policy (SGT Transport)

 

Adaptive Policy (SGT Assignment)

 

 

Internet Outages

 

 

ThousandEyes Support with Meraki Dashboard**

 

 

SD-Internet Steering and Policies

 

 

Web App Health

   

WAN Health

   

VoIP Health 

   

Smart breakout

   

**Requires a separate license

 

Note: For licenses and their respective features available in mainland China, please refer to the following article for the details.

https://documentation.meraki.com/zGeneral_Administration/Licensing/Cisco_Meraki_Licensing_Guidelines_and_Limitations/CH

 

Teleworker Gateway License Breakdown

The Meraki Teleworker Gateway is a type of a security appliance intended for use in small remote offices and homes of remote workers. Allowing them to securely connect back to their head offices while also offering the same security as our MX security appliance Platform. 

With the introduction of the Z4/C, we are also introducing two new types of licenses for the Teleworker series.

Note: These licenses are not be supported by the Z1 and Z3 teleworker gateways

Z-Enterprise

Secure Teleworker

  • Essential SD-WAN Features

  • Secure connectivity & basic security

  • Advanced Security Features

  • Advanced SD-WAN Features

  • Advanced Analytics 

Teleworker Features by License Options   

Feature

Z-Enterprise

Secure Teleworker

Centralized management

Zero-touch firmware updates

True zero-touch provisioning

24x7 enterprise support

Open APIs

Automatic WAN failover

Sub-second site-to-site VPN failover

Sub-second dynamic path selection

Stateful firewall

VLAN to VLAN routing

Advanced Routing

Traffic shaping/prioritization

Site-to-site VPN

Client VPN

Splash pages

Configuration templates

Group Policies

Client connectivity alerts

Source-Based Routing

Local Breakout (IP based)

Umbrella DNS Integration**

Geography based firewall rules

 

Content filtering

 

YouTube Content Restriction

 

Web Search Filtering

 

Cisco Advanced Malware Protection (AMP)

 

Threat Grid Integration**

 

WAN Health Analytics (MI)

 

VoIP Health Analytics (MI)

 

Smart breakout

 

Z4 Licenses are as follows: 

  • Z-Enterprise: LIC-Z4-ENT-[X]Y
  • Secure Teleworker: LIC-Z4-SEC-[X]Y

X= Number of Years

This new license type will bring SDW+ license on a per-network basis for organizations on the Coterm Licensing model with Advanced Security Licensing. Customers can now purchase the appropriate license type and assign them to the respective network to get all SD-WAN features on a per-network basis.  The terms available are 1, 3 and 5 years only. Please see the table below to have the MX platforms mapped to their respective SKUs.

Once the licenses are claimed under Organization→ License info, you will need to go to Insight→ Configure→ Licensing to assign the licenses to the respective compatible networks.

  1. You can assign the licenses using the ‘Add licenses to network’ or remove licenses using the ‘Remove Licenses from network’ 

  2. You can assign a higher license-tiered SKU to a lower licensed-tiered network. Example: You can assign  LIC-MX-SDW-M-1YR to a MX64

Note: No extra term will be added or subtracted when you add a higher-licensed tier to lower-tiered devices. 

If Per Dev SDW+ is added to an already licensed MI network, this will replace the license and the MI license will be added back to the MI license pool 

3. Assigning the Per Dev SDW+ SKU to a network will give that network access to all of the below SD-WAN features

Note: Enterprise licensed customers cannot be in a mixed license environment. 

Advance Security License is required to support a mixed license environment on the Coterm Licensing model. Please refer to the FAQ section below for mode details.

Per Device SD-WAN+ License is a per network license used to upgrade a network from Advance Security to SD-WAN+.

MX Platform SKU
MX64/W, MX65/W LIC-MX-SDW-XS-1Y
MX64/W, MX65/W LIC-MX-SDW-XS-3Y
MX64/W, MX65/W LIC-MX-SDW-XS-5Y
   
MX67/C/W, MX68C/W LIC-MX-SDW-S-1Y
MX67/C/W, MX68C/W LIC-MX-SDW-S-3Y
MX67/C/W, MX68C/W LIC-MX-SDW-S-5Y
   
MX75, MX84, MX85 LIC-MX-SDW-M-1Y
MX75, MX84, MX85 LIC-MX-SDW-M-3Y
MX75, MX84, MX85 LIC-MX-SDW-M-5Y
   
MX95, MX100, MX105 LIC-MX-SDW-L-1Y
MX95, MX100, MX105 LIC-MX-SDW-L-3Y
MX95, MX100, MX105 LIC-MX-SDW-L-5Y
   
MX250, MX450 LIC-MX-SDW-XL-1Y
MX250, MX450 LIC-MX-SDW-XL-3Y
MX250, MX450 LIC-MX-SDW-XL-5Y

How are licenses enforced on MX security appliance?

The licenses are on a per-model basis. Every MX model has a corresponding license. They are non-transferable between appliance models. For instance, an MX64 license will not be covered by an MX84 license.

 

Can we mix two license types in a single organization?

MX licensing can now support mixed licensing in Co-termination licensing model with Per Device SD-WAN+ licenses. For instance, if you have 25 MX networks in your organization, you can have 20 MX devices with Advance Security features and upgrade 5 MX devices with Per Device SD-WAN Plus licenses to get SD-WAN features. However, this is not supported with Enterprise licenses.  

Note: Enterprise licensed customers cannot be in a mixed license environment. However, this does not apply to Z-Series devices or vMXs (including the new Z-Series devices that can use Secure Teleworker licenses). Z-Series and vMX licenses can be added to organizations regardless of the MX license type currently applied.

 

Is there a separate license to cover support or device warranty or software upgrades?
Each license is inclusive of device RMA, 24x7 enterprise support, and software upgrades. 

 

Will there be a requirement to pay extra for new features?

New features are added by license type.

  • Features added to the enterprise license option will be available free-of-charge to all existing MX customers.
  • Features added to the advanced security license option will be available free-of-charge to all existing MX customers with an advanced security or SD-WAN Plus license.
  • Features added to the Secure SD-WAN Plus license option will be available free-of-charge to all existing MX customers with an SD-WAN Plus license.

 

Are MX licenses available on both Co-Term and PDL versions?

Yes. All the MX licenses are available under Co-Term as well as PDL (Per Device Licensing). For More information and general differences between the two, please see the documentation on Meraki Licensing.

 

Can you move from one MX license edition to another, for example, Enterprise to Advanced Security or SD-WAN Plus?

Currently, there are two ways to move to a different MX license edition:

  • Purchase the desired MX license type (one license for all compatible MXs in the organization) and apply them to the organization which will convert the entire organization to the desired license type. Note: This will adjust your remaining licensing term depending on the license type (duration, MX model, license type)
    • If you are claiming the key using the “Renew my dashboard” option (in the co-termination licensing model), it will automatically upgrade the entire organization to reflect the product edition of the new key. Note: There is no such thing as a “partial” renewal in the co-termination model, so if you wish to convert using this option, you must ensure you have new licenses for all other devices as well.

    • If you are claiming the license using the “License more devices” option, you will need to reach out to Meraki Support for assistance, as the organization (all existing MX licenses) will first need to be upgraded to the desired security edition before the dashboard allows you to claim the new security edition to your organization.  In order for Support to fulfill the request, it must come from a write privilege organizational-level administrator.

  • Contact Meraki support and convert the organization to the desired license option. Note: You will have a new co-termination date for your organization with this method.
    • If upgrading moving from Enterprise to Advanced Security, the remaining credit for the MXs will be cut in half due to the increased feature set.
    • If upgrading from Enterprise to SD-WAN+, the remaining credit for the MXs will be cut by 60 to 75% depending on the MX model being converted.
    • If upgrading from Advanced Security to SD-WAN+, the remaining credit for the MXs will be cut by 25% to 50% depending on the MX model being converted.
    • The following MXs are eligible for SD-WAN+ Upgrades: MX64/W, MX65/W, MX67/W/C, MX68/W/CW, MX75, MX84, MX85, MX95, MX100, MX105, MX250, MX450
    • If you are choosing to downgrade your organization's security edition, there will be no additional credit given back.

Note: Upgrading to SD-WAN+ is only available in Co-Term through the above-mentioned ways.  To upgrade to SD-WAN+ in a Per-Device-Licensing organization, you must purchase the corresponding SD-WAN+ device licenses and claim them to the organization, which will force the organization into SD-WAN+.

 

Are free trials available for each of the MX license types?
Yes. Please contact your Meraki Sales representative for more information.

 

How does Warm-Spare MX set up work with the license?
In a network where two MXs are configured in Warm-Spare mode will only require one MX license.

 

Will Meraki Insight be available as a separate license?
Yes. Meraki Insight (included in Secure SD-WAN Plus license by default) will still be available as a separate license.

 

Will new features under Meraki Insight be restricted to the Secure SD-WAN Plus license only?
No. Any new features that released as a part of MI will also be available under separate MI licenses.

 

If I have the Advanced Security license + MI or Enterprise + MI, do I essentially have the new Secure SD-WAN functionality?
No, you will miss out on the new features (present and future) coming under the SD-WAN Plus license. However, you will have more flexibility in being able to move the MI license around between devices.

 

Is MI going to be merged as a Secure SD-WAN Plus license only? Is MI going away?
No. Meraki Insight is available for customers who have different needs. 

 

Is Per Dev SDW+ going to be available on PDL or subscriptions?

No, Per Dev SDW+ is only available in Co-term and won’t be available in PDL or subscriptions.

 

Can Per Dev SDW+ be assigned to networks with Enterprise License?

No, the minimum requirement to have Per Dev SDW+ assignment is for the org to have Advance Security licenses.

 

Will Per Dev SDW+ be supported on networks that are bound to a template?

Per Dev SDW+ is not supported on networks that are bound to a template. However, there are plans to support it soon. 

 

Will Per Dev SDW+  affect my co-term date?

Yes, it will follow the same logic as the other licenses and will affect the co-term end date.