Meraki VPN Licence in Singapore: What the MX Licence Covers
Last updated: October 2026
You do not buy a separate Meraki VPN licence. The MX licence covers three VPN options in every tier:
Auto VPN: site-to-site tunnels between Meraki sites.
IPsec VPN to non-Meraki peers.
Client VPN: the built-in IKEv2 or L2TP remote access.
Two items do cost extra. First, each site with VPN needs its own licensed Meraki device: an MX, Z-series or vMX. Second, Cisco Secure Client (AnyConnect) on the MX needs a Cisco Secure Client licence for each user. Reach out to us for a quote if needed.
Megatron Technology is an authorised Cisco Networking Partner in Singapore. We checked these facts on 7 October 2026 against the Cisco Meraki documents below.
What Meraki VPN options does an MX give you?
| Option | What it is | Typical use | Licence |
|---|---|---|---|
| Auto VPN | Meraki builds and keeps encrypted tunnels between your Meraki sites. You turn it on in the dashboard. The cloud manages keys and routes. | HQ to branches, branch to data centre, full mesh or hub-and-spoke | In the MX feature set. Each site needs its own licensed MX / Z / vMX. |
| Non-Meraki site-to-site (IPsec peers) | A standard IPsec tunnel to a firewall from a different manufacturer, or to a cloud gateway. | Connection to a partner, a FortiGate at another office, or a cloud VPN gateway | In all MX tiers ("3rd party peering"). |
| Client VPN (IKEv2 or L2TP) | Remote users connect with the VPN client built into their laptop or phone. | Small remote-access needs; staff who connect sometimes | In all MX tiers. |
| Cisco Secure Client (AnyConnect) on MX | Cisco's full VPN client. The MX terminates the connection. | Organisations that already use Secure Client, or that need SAML | MX side included. Users need a Cisco Secure Client licence (Advantage, Premier or VPN Only). |
Does Meraki Auto VPN need a separate licence?
No. Meraki's Auto VPN Configuration Settings page says Auto VPN is part of the MX and Z-Series feature set. It does not need a separate licence. Each MX, Z or Secure Router still needs its own device licence.
The licence tier tables agree. The Co-Term MX/Z licensing page includes site-to-site VPN and Client VPN in Enterprise, Advanced Security and Secure SD-WAN Plus. The MX subscription page includes the same items in Essential and Advantage.
Thus, choose your tier for security (threat protection, content filtering) and SD-WAN analytics. Do not choose it for VPN. Every tier has the basic VPN features.
Does Meraki Client VPN for remote staff cost extra?
No. Meraki's Client VPN Overview gives two built-in options:
IKEv2 (from MX firmware 26.1.x). It uses a Meraki-managed or custom certificate. From 26.1.2, IKEv2 Client VPN supports RADIUS authentication only.
L2TP over IPsec. It uses the built-in client on most operating systems, with a pre-shared key and user credentials. Meraki is removing old ciphers such as 3DES. You may need to update old client settings.
Depending on the mode, users sign in with Meraki cloud accounts, RADIUS or Active Directory. Meraki charges no per-user licence for these options. The MX licence covers them.
Client VPN has limits for a large remote workforce. It operates on the MX primary uplink only. Administrators apply group policies manually, not automatically at connection. For a large remote workforce, many organisations choose Secure Client or a cloud security service.
When does Meraki remote access cost extra?
In two cases.
1. Cisco Secure Client (AnyConnect) on the MX. Meraki's AnyConnect Licensing on the MX page covers this case. Customers must have a valid AnyConnect / Secure Client licence (Advantage, Premier or VPN Only). The dashboard does not check the licence. But you need it for compliance and for Cisco TAC support of the client. On the MX, you need Premier only for SAML authentication.
2. Cloud-delivered security. A cloud remote-access service, for example Cisco's SSE / SASE offers, is a separate subscription. Cisco's Secure Client ordering guide says you buy headends and cloud services separately from client licences.
Neither case is a second MX licence. Both are user or service licences, sized by the number of users.
What does each site need for Meraki VPN?
Auto VPN connects licensed Meraki devices only. A branch without a Meraki device cannot join Auto VPN. It can use only a standard IPsec tunnel from its own firewall. Typical sites:
Branch office: one licensed MX of the correct size. For resilience, add a warm spare with no extra MX licence. See Meraki MX Warm Spare: One Licence for Two Appliances.
Executive home office: a Z-series teleworker gateway. It needs its own Z licence.
Cloud (AWS / Azure / GCP): a virtual MX (vMX). It needs its own licence. On Subscription, the MX product classes cover the vMX.
How is Meraki VPN licensing different from FortiGate?
The main point is the same: the firewall includes site-to-site IPsec and remote access. The details are different. On FortiGate, you must also check which SSL VPN modes your FortiOS version and model support. You must also track FortiClient EMS / ZTNA endpoint licences, if you use them. Read FortiGate VPN Options and What You Actually Licence and FortiGate vs Meraki MX for Singapore Offices.
What information do we need to quote Meraki VPN?
How many sites do you have? Which sites already have a Meraki MX or Z?
Do you have non-Meraki peers (partners, cloud gateways, other firewalls)?
How many remote users do you have? Do they need SAML / SSO?
Does your organisation use Co-Term or Subscription licensing?
Do you need a warm spare at HQ or at the data centre hub?
Frequently asked questions
Do we need an extra licence to turn on Meraki Auto VPN?
No. Meraki says Auto VPN is part of the MX and Z feature set, with no separate licence. Each device in the VPN needs its normal Meraki licence.
Is Meraki Client VPN only in the higher tier?
No. All MX tiers include Client VPN: Enterprise, Advanced Security and Secure SD-WAN Plus on Co-Term, and Essential and Advantage on Subscription.
Can a Meraki MX build a VPN to a FortiGate?
Yes, as a non-Meraki IPsec peer. Meraki publishes IPsec VPN configuration settings for third-party peers. The two sides must use the same IKE version, proposals and subnets.
Is there a per-user charge for Meraki Client VPN?
No, not for the built-in IKEv2 or L2TP Client VPN. Cisco Secure Client (AnyConnect) on the MX needs a Cisco Secure Client licence for users that is a separate license purchased from your partner.
Does the MX licence tier change VPN throughput?
No. The tier sets features, not hardware capacity. The MX model sets VPN capacity. Ask us to size the MX for your users and links, and check the current model datasheet.
How do you plan Meraki VPN with a Cisco Networking Partner in Singapore?
Send us your site list, your number of remote users and your current serials. We map Auto VPN, Client VPN or Secure Client to your licence model. We quote only what you need. Lead times are typically 1–2 weeks, depending on SKU. Meraki licence terms are commonly 1, 3 or 5 years. Support options are 24x7x4, 8x5xNBD and 8x5x4.
Megatron Technology Pte Ltd (est. 1990, UEN 199002644W) is an authorised Cisco Networking Partner and Managed Services Provider in Singapore, and a Fortinet reseller. Our 4 Cisco-certified engineers design, licence, procure, deploy and support Cisco Meraki, FortiGate and Cisco enterprise networks. Verify us on the Cisco Partner Locator. Contact: +65 6346 2001 · info@megatron.com.sg · 2 Kallang Avenue #08-17 CT Hub, Singapore 339407. See our Cisco Meraki page or contact us.