Meraki Advanced Security licence: what it adds

Where Advanced Security fits

Every Meraki MX appliance needs a licence to operate, one licence per appliance. On co-termination licensing, Meraki sells three editions for the MX:

• Enterprise: Meraki's "Auto VPN and a firewall" edition, with essential SD-WAN, stateful firewall, traffic shaping and client VPN.
• Advanced Security: everything in Enterprise plus a full unified threat management (UTM) feature set, for sites that break out to the internet directly.
• Secure SD-WAN Plus: everything in Advanced Security plus Meraki Insight analytics and ThousandEyes features for organisations that rely heavily on SaaS and data-centre applications.

Meraki's own shorthand for Advanced Security is the customer who says "I connect directly to the internet so need a UTM too". If your branch or office traffic goes straight out to the internet rather than back through a central firewall, the MX is your security perimeter, and that is the case Advanced Security is built for. Our comparison of Meraki Enterprise vs Advanced Security vs Secure SD-WAN Plus puts all three side by side.

This page covers the co-term editions. On subscription licensing the MX uses Essentials and Advantage tiers instead; more on that below.

What the Advanced Security licence adds

• Intrusion detection and prevention (IDS/IPS): the MX inspects traffic against Cisco's intrusion rule sets and can alert on or block known attack patterns.
• Content filtering powered by Talos: block categories of websites using Cisco Talos threat intelligence.
• Cisco Advanced Malware Protection (AMP): files passing through the MX are checked against Cisco's malware intelligence so known malicious files can be blocked.
• Geography-based firewall rules: allow or deny traffic to and from countries, alongside your normal layer 3 and layer 7 rules.
• YouTube content restriction and web search filtering: enforce restricted modes for YouTube and safe search on supported search engines, which schools and public-facing networks often need.
• Trusted traffic exclusions: exclude trusted traffic, identified by NBAR application recognition, from security inspection.
• Adaptive Policy transport: the MX can carry Cisco security group tags (SGTs) across the network, as listed in Meraki's feature table for this edition.

Everything in the Enterprise edition comes too: Auto VPN, stateful firewall, WAN failover and load balancing, SD-WAN steering, traffic shaping, client VPN, NBAR layer 7 application recognition, group policies, splash pages, configuration templates and the Meraki dashboard itself. The licence also covers Meraki's technical support, hardware replacement (RMA) and firmware updates for the appliance. Meraki says features it adds to the Advanced Security edition later are available to existing Advanced Security customers at no extra charge.

What still needs a separate licence

Meraki's feature table marks several integrations as available on Advanced Security but requiring a licence of their own. Budget for these separately if you want them:

If you already run Cisco Umbrella, our sister site explains Cisco Umbrella with Meraki in detail. For organisations moving security to the cloud entirely, Cisco SASE is the bigger picture; an MX with Advanced Security and a cloud security service are often used together rather than one replacing the other.

Licensing rules that catch people out

Advanced Security follows Meraki's co-term rules, plus a few MX-specific ones from Meraki's licensing documentation:

1. Licences are per MX model. Every MX model has its own licence and they are not transferable between models. A licence for a small branch appliance will not cover a larger one.
2. One edition per organisation. In co-term, the MX edition is uniform across the organisation. You cannot have most appliances on Enterprise and a few on Advanced Security in the same organisation; Meraki's answer is a second organisation.
3. Warm spare pairs need one licence. Two MX appliances configured as a warm spare pair (high availability) need only one MX licence between them.
4. Virtual MX must match. If the organisation's MX edition is Advanced Security or Secure SD-WAN Plus, any vMX in it must use an Advanced Security vMX licence; an Enterprise vMX licence cannot be used there.
5. Teleworker gateways are different. Z-series teleworker gateways use their own licences and can be added to an organisation whatever its MX edition. See our Meraki teleworker gateway page.
6. It shares the co-term date. Like every co-term licence, Advanced Security licences feed into the single organisation expiry date. Our guide to Meraki co-term licensing shows how that date is calculated.

Advanced Security is also available on per-device licensing for organisations that already use it; Meraki no longer accepts new conversions to that model (see Meraki per-device licensing).

Upgrading from Enterprise to Advanced Security

Meraki describes two routes for moving a co-term organisation from Enterprise to Advanced Security:

• At renewal. Claim Advanced Security licences for every MX using the "Renew my dashboard" option and the whole organisation moves to the new edition. There is no partial renewal in co-term, so the renewal must cover all your other devices too. Our guide to Meraki licence renewal walks through the process.
• Mid-term, through Meraki support. Buy Advanced Security licences and ask Meraki support to convert the organisation, or ask support to assess an upgrade of your existing licences. Meraki adjusts the remaining term to reflect the higher edition: its documentation says that moving from Enterprise to Advanced Security cuts the remaining credit on your MX licences in half. Support-led changes are irreversible and must be requested by an organisation administrator with write access.

Meraki also notes that if the wrong edition key was bought within the last 30 days, it will not convert the key; it must be returned and the correct one ordered. That is one reason to have the edition decided before the order is placed.

Downgrading is possible too, either with an Enterprise renewal key that covers every device or through Meraki licensing support, but Meraki gives no additional time back when you move to a lower edition and the change cannot be reversed.

Advanced Security on subscription licensing

If your organisation is on Meraki subscription licensing (Cisco Networking Subscription), there is no product called Advanced Security. The MX is licensed in Essentials and Advantage tiers instead, bound to networks rather than the whole organisation.

Meraki's published subscription feature table for the MX lists IDS/IPS, Talos content filtering, Advanced Malware Protection, geography-based rules and web search and YouTube restrictions in the Essentials tier, and puts the Meraki Insight analytics, ThousandEyes features, SD-Internet steering and smart breakout in Advantage. Read our Meraki Essentials vs Advantage guide before comparing quotes across the two models, because the names do not line up one to one. Subscription and co-term licences cannot be mixed in one organisation.

How Forever Systems helps

Forever Systems is a Cisco Partner. For Meraki MX licensing we can:

1. Review your organisation's current edition, device counts and co-term date.
2. Work out whether Advanced Security, Secure SD-WAN Plus or a subscription tier fits how your sites reach the internet.
3. Quote the licences, matched to each MX model, with any separate Umbrella or malware analysis licences you want.
4. Help you configure IDS/IPS, content filtering and malware protection policies once the licence is applied.

For MX hardware supply and installation, see our Meraki MX service page. Prices depend on the appliance models, the term and the edition, so ask us for a quote. Contact us to talk through the right edition for your appliances.