Guide
Which firewall?
Cisco has two firewall families with different philosophies. Meraki MX is simple and cloud-managed with built-in SD-WAN. Secure Firewall is a traditional next-generation firewall for those who want full control.
Short answer
Choose Meraki MX if you want simple cloud management, VPN between offices and SD-WAN without an in-house firewall expert; the licence is required and chosen by protection level. Choose Cisco Secure Firewall if you need detailed rules, tunable intrusion prevention and local control. Size by throughput with the security features enabled, not by the maximum figure.
When does Meraki MX fit?
Fits offices and branches that want VPN between sites, SD-WAN and security without an in-house firewall expert. A licence is required and chosen by protection level (Enterprise, Advanced Security or Secure SD-WAN Plus).
When does Cisco Secure Firewall fit?
Fits when you need detailed rules, tunable intrusion prevention or integration with other security products. The software comes in two variants: Threat Defense (NGFW/TD in the part number) with full security features, and ASA for traditional firewall and VPN.
How do you size it right?
Look at throughput with the security features enabled, not just maximum throughput, and count the number of VPN users. We are happy to help with sizing.
Read more: Firewalls for 50 users · How Cisco licensing works · Meraki or Catalyst?
Conclusion
How we would choose
Examples:
Meraki MX68 (PoE)
Small office with cloud management and SD-WAN.
Secure Firewall 1210CE (Threat Defense)
Small office wanting Secure Firewall with Threat Defense.
Secure Firewall 1120 (Threat Defense)
Offices that need SFP ports for fibre straight into the firewall (4× 1G SFP).
Frequently asked questions
Questions we often get
Is a licence needed for the firewall to work?
For Meraki MX yes – the licence is required for operation and management. Secure Firewall works as a firewall with the base licence, but IPS, malware protection and URL filtering require a subscription.
Is VPN included?
Site-to-site VPN is included in both. Remote-access VPN for users on Secure Firewall requires a separate Cisco Secure Client licence; tell us how many users and we will price it.
Can we have two firewalls for redundancy?
Yes. Meraki MX can run as a warm spare – two units of the same model, and the pair needs only one licence. Secure Firewall can run in high availability (HA). Mention it in the request and we will include two units and the right licences.