How Cisco licensing works

Short answer

You buy the hardware once; what comes on top depends on the product. Catalyst 9200–9600 require a subscription for 3, 5 or 7 years. Meraki requires a licence for operation and management (1–10 years). Secure Firewall needs a subscription for IPS and URL filtering, and Catalyst 8000 routers are licensed by traffic tier. Catalyst 1200 and 1300 have no licence.

Which licensing models are there?

You buy the hardware once. What differs is what is needed on top: Catalyst switches require a subscription, Meraki requires a licence to work at all, and Secure Firewall works without a subscription but the protection (IPS, malware, URL filtering) requires one. A support contract is optional.

Catalyst switchC9300-48P-A

Optional Support contractSmart Net: TAC around the clock and faster replacement.

Required SubscriptionEssentials or Advantage, 3, 5 or 7 years.

Included HardwareBought once. Perpetual network licence included (-E or -A).

MerakiMS130-24P-HW

Included SupportHardware replacement, 24/7 support and updates are included in the licence.

Required Meraki licence1–10 years. Without a licence the device stops working.

Included HardwareBought once (-HW).

Secure FirewallCSF1210CE-TD-K9

Optional Support contractSmart Net: TAC around the clock and faster replacement.

For protection Security subscriptionIPS, malware protection and URL filtering, 1, 3 or 5 years.

Included HardwareBought once. Firewall, NAT, routing and application control included.

Catalyst switches: Essentials or Advantage

Catalyst 9200, 9300, 9400, 9500 and 9600 require a subscription at purchase, for 3, 5 or 7 years. Essentials is enough for most office networks. Advantage is needed for segmentation with SD-Access and more advanced analytics and automation. Catalyst 1200 and 1300 have no subscription at all. Read more in the Essentials vs Advantage guide.

Read more: Essentials or Advantage? · What does a Cisco licence cost?

Meraki: the licence is required for operation and management

Meraki products are managed from the cloud and require a licence. The licence is tied to the model and comes in 1, 3, 5, 7 or 10 years. Meraki has two licensing models: the older one (co-term/per device) with the tiers below, and the newer subscription model with the tiers Essentials and Advantage.

• Meraki MX (firewall): Enterprise – baseline security and SD-WAN; Advanced Security – adds IPS, malware protection and content filtering; Secure SD-WAN Plus – more SD-WAN analytics
• Meraki MS (switch): Enterprise; Advanced (A, for MS130/MS150 and Catalyst-M) adds e.g. Adaptive Policy
• Meraki MR and Catalyst access points in Meraki mode: Enterprise or Advanced

Secure Firewall: security subscriptions

The base licence is included and gives firewall, NAT, routing and application control. The protection features require a subscription for 1, 3 or 5 years, and the letters in the licence number tell you what is included. Remote-access VPN for users requires a separate Cisco Secure Client licence.

• T – Threat: intrusion prevention (IPS)
• M / AMP – Malware Defense: protection against malware
• C / URL – URL filtering
• TMC – all of the above; the most common choice. T is required for M and C.

Routers: SD-WAN licence and HSEC

Catalyst 8000 routers are licensed by how much traffic they need to handle: roughly T0 25 Mbit/s, T1 250–500 Mbit/s, T2 0.5–2 Gbit/s and T3 up to 20 Gbit/s (depending on model), in Essentials or Advantage. T3 and above require Advantage. On the Catalyst 8200 and 8300 the HSEC export licence is also required for tier T2 and above, i.e. when the router must handle more than about 250 Mbit/s of encrypted traffic. HSEC is perpetual and bought once per router.

Access points

Catalyst access points are licensed per access point for at least 3 years. The new models – Wi-Fi 7 (CW917x) and Wi-Fi 6E such as the CW9162I and CW9166I – fall under Cisco Networking Subscription (Essentials or Advantage), which covers both cloud and controller management. Older controller-managed models are licensed with Catalyst Center Essentials or Advantage, and in Meraki mode the Meraki licence applies. We confirm the right licence in the quote.

What happens when the licence expires?

Catalyst switches keep working on their perpetual network licence, but the features and support in the subscription end. For Meraki a 30-day grace period starts; on the older licensing model the devices then stop working, on the subscription model they keep forwarding traffic but can no longer be managed or updated. Secure Firewall still passes traffic, but IPS, malware and URL protection stop. We remind you well before renewal.