In short
Meraki Enterprise is the MX edition for SD-WAN, Auto VPN and a stateful firewall. Advanced Security adds unified threat management: IDS/IPS, Talos content filtering, malware protection and geo-IP rules. Secure SD-WAN Plus adds Meraki Insight application and WAN health analytics, smart SaaS breakout, SD-Internet steering and ThousandEyes features. One edition applies across a co-term organisation.
Want an impartial recommendation?
Tell us about your users, systems and priorities and we will tell you which option fits, and why.
The three MX editions in one line each
Meraki describes its three co-term editions for the MX by the customer each one is for:
- Enterprise: "All I require is Auto VPN and a firewall." Essential SD-WAN, secure connectivity and basic security.
- Advanced Security: "I connect directly to the internet so need a UTM too." All Enterprise features plus fully featured unified threat management.
- Secure SD-WAN Plus: "My business is reliant on SaaS, IaaS or data-centre-served apps." All Advanced Security features plus machine-learning analytics from Meraki Insight, smart SaaS quality of experience and internet intelligence from ThousandEyes.
Each MX needs one licence of the chosen edition, matched to its model. The licence also covers Meraki's technical support, hardware replacement and firmware updates for that appliance, whichever edition you choose.
Feature comparison: Enterprise vs Advanced Security vs Secure SD-WAN Plus
| Feature | Enterprise | Advanced Security | Secure SD-WAN Plus |
|---|---|---|---|
| Dashboard management, zero-touch provisioning and firmware | Yes | Yes | Yes |
| Auto VPN and third-party site-to-site VPN | Yes | Yes | Yes |
| Automatic WAN failover, load balancing, cellular failover | Yes | Yes | Yes |
| SD-WAN steering, sub-second path selection, MPLS to VPN failover | Yes | Yes | Yes |
| Stateful firewall and layer 7 (NBAR) application enforcement | Yes | Yes | Yes |
| Traffic shaping, group policies, splash pages | Yes | Yes | Yes |
| Client VPN | Yes | Yes | Yes |
| Configuration templates | Yes | Yes | Yes |
| IPsec tunnels to cloud security services (SSE) with monitoring | Yes | Yes | Yes |
| Intrusion detection and prevention (IDS/IPS) | - | Yes | Yes |
| Content filtering powered by Talos | - | Yes | Yes |
| Cisco Advanced Malware Protection (AMP) | - | Yes | Yes |
| Geography-based firewall rules | - | Yes | Yes |
| YouTube content restriction and web search filtering | - | Yes | Yes |
| Trusted traffic exclusions | - | Yes | Yes |
| Adaptive Policy: security group tag transport | - | Yes | Yes |
| Adaptive Policy: security group tag assignment | - | - | Yes |
| SD-Internet steering and policies | - | - | Yes |
| Smart breakout for SaaS applications | - | - | Yes |
| Meraki Insight: WAN Health, VoIP Health, Web App Health | - | - | Yes |
| Internet Outages (ThousandEyes data) | - | - | Yes |
| ThousandEyes support in the dashboard (separate licence) | - | - | Yes |
Source: Meraki's MX licensing documentation, latest stable firmware at the time of writing. Umbrella DNS integration, Cisco Secure Malware Analytics, Cisco XDR integration and the ThousandEyes agent integration are available from Advanced Security upwards but each needs a separate licence, and ThousandEyes support in the dashboard on Secure SD-WAN Plus also needs its own licence. Meraki notes that some features depend on firmware and hardware, so we check them against your appliances before quoting.
Still not sure which way to go? Ask us
Tell us what matters most to you and we will recommend one, with the trade-offs explained.
Which edition suits which network?
Meraki's own positioning and the feature table point to a few patterns:
- Enterprise suits networks where the MX is mainly a VPN and SD-WAN device: branch traffic returns over Auto VPN to a hub or data centre that already has its own security stack, or another security service inspects internet traffic. It is the simplest way to put sites in one dashboard with resilient WAN links.
- Advanced Security suits sites that go straight to the internet. If the MX is the only firewall between users and the internet, IDS/IPS, content filtering and malware protection are the features that make it a security appliance rather than a router. Schools, shops, offices and sites with guest Wi-Fi often land here.
- Secure SD-WAN Plus suits organisations whose work depends on cloud applications and voice. Insight's WAN, VoIP and web application health views show whether a problem is your link, the provider or the application, and smart breakout and SD-Internet steering send SaaS traffic by the best available path.
Questions that usually settle the choice:
- Does internet traffic leave each site directly, or return to a hub first?
- Is anything else already inspecting web traffic, such as a DNS or cloud security service?
- Do voice calls and SaaS applications need monitoring by path and provider?
- Do some sites need more than others, which might point to per-network Secure SD-WAN Plus?
Our page on the Meraki Advanced Security licence goes deeper on the middle edition. If you are comparing the MX with a dedicated next-generation firewall, read Cisco Secure Firewall vs Meraki MX on our Cisco security site.
Per-network Secure SD-WAN Plus
Because one MX edition applies to a whole co-term organisation, Meraki created a per-device Secure SD-WAN Plus licence for organisations that only need SD-WAN Plus at some sites. Meraki's rules for it:
- It is available only on co-termination licensing, not on per-device licensing or subscription.
- The organisation must already be on Advanced Security. Enterprise organisations cannot use it.
- It is assigned to individual networks (in the dashboard under Insight licensing) and upgrades that network from Advanced Security to SD-WAN Plus features.
- It does not apply to networks bound to a configuration template.
- Terms are one, three or five years, and it feeds into the organisation's co-term date like any other licence.
Meraki's own example: an organisation with 25 MX networks could run 20 on Advanced Security and upgrade five with per-device Secure SD-WAN Plus licences. Meraki Insight is no longer sold as a separate licence, so this add-on or the full Secure SD-WAN Plus edition is the way to get Insight analytics.
Weighing up the options?
We can compare them against your own requirements and recommend what fits.
Moving between editions
Changing edition in co-term is a whole-organisation change. Meraki's documentation describes the options:
- Renew into a new edition. Claim the new edition's licences for every MX with the renew option and the organisation moves to it. There is no partial renewal, so cover every device. See Meraki licence renewal.
- Convert mid-term through Meraki support. Support adjusts your remaining term by the cost difference between editions. Meraki says moving from Enterprise to Advanced Security halves the remaining MX credit; Enterprise to Secure SD-WAN Plus cuts it by 60 to 75 per cent depending on model; Advanced Security to Secure SD-WAN Plus cuts it by 25 to 50 per cent. Support-led conversions are irreversible.
- Downgrade at renewal. Possible, but no credit is given back.
Plan edition changes around your co-term date where you can: it is usually simpler to choose the edition at renewal than to convert part-way through a term.
What about subscription licensing?
On Meraki subscription licensing the three edition names disappear. The MX is licensed in Essentials or Advantage tiers per network, and an order can mix the two. Meraki's subscription feature table lists the Advanced Security features in Essentials and the Insight, ThousandEyes, SD-Internet and smart breakout features in Advantage; configuration templates can be used in Advantage, but only for Essentials features. A virtual MX supports Essentials only.
Our Meraki Essentials vs Advantage guide covers every product family, and Meraki licensing models explains when subscription or co-term makes more sense.
How Forever Systems helps
Forever Systems is a Cisco Partner. We can review how your sites connect, what security already sits upstream and which applications matter most, then recommend an edition (or a subscription tier) and quote it against your exact MX models. We can also help plan the move between editions so it lines up with your renewal.
For MX hardware and SD-WAN design, see our Meraki SD-WAN service page. Pricing is confirmed at quote. Contact us to compare the options for your network.
Working with us on Cisco Meraki
Forever Systems helps organisations plan, buy and run cloud-managed networks built on Cisco Meraki wireless, switching, security and SD-WAN.
- Plan the network: we look at your sites, users and existing kit, and can arrange a wireless site survey before anything is ordered
- Choose the right products: access points, switches, security appliances, cellular gateways, sensors and cameras sized to what each site needs, rather than a one-size bundle
- Licensing made clear: we explain co-termination, per-device and subscription licensing, check renewal dates and quote the licences you need
- Deployment help: we can set up the Meraki dashboard, organisations, networks, templates and policies, and help move you from older or on-premise kit
- Ongoing help: changes, licence renewals and reviews as your sites grow, with the scope agreed at quote
Ask us for a quote and we will confirm what is included for your organisation.
Frequently asked questions
What is the difference between Meraki Enterprise and Advanced Security licences?
Enterprise provides SD-WAN, Auto VPN, stateful firewall, traffic shaping and client VPN. Advanced Security adds unified threat management: IDS/IPS, Talos content filtering, Cisco Advanced Malware Protection, geography-based firewall rules, YouTube and web search restrictions and trusted traffic exclusions.
What does Secure SD-WAN Plus add over Advanced Security?
Meraki Insight analytics (WAN Health, VoIP Health and Web App Health), smart breakout for SaaS applications, SD-Internet steering and policies, Internet Outages, ThousandEyes support in the dashboard (which needs a separate ThousandEyes licence), and security group tag assignment for Adaptive Policy.
Can I buy Meraki Insight on its own?
No. Meraki has deprecated the separate Meraki Insight licence. Insight features come with the Secure SD-WAN Plus edition or the per-network Secure SD-WAN Plus add-on.
Can different MX appliances use different editions?
Not in one co-term organisation: the MX edition is uniform across it. The exception is the per-network Secure SD-WAN Plus licence, which Advanced Security organisations can assign to selected networks.
Do the same editions exist on subscription licensing?
No. Subscription uses Essentials and Advantage tiers per network instead. The feature split is similar but not identical, so compare the subscription tables rather than assuming a one-to-one match.
Still deciding?
Ask us and a member of our team will reply by email.