Zenarmor vs Cisco Meraki: the Meraki MX alternative, compared honestly

Short answer: Cisco Meraki MX is excellent if you want the simplest possible cloud management for a full Meraki environment with Auto VPN and SD-WAN. Zenarmor is the better Meraki alternative if you need full TLS inspection, want per-user protection (at home and on the road as well), prefer not to depend on a single hardware and licensing model, and want to keep your reporting in the Netherlands, Germany or on-premises.

The most important practical difference: according to Meraki's documentation, devices stop passing client traffic if an organisation (on co-termination or per-device licensing) still lacks valid licences after a 30-day grace period. The OPNsense firewall underneath Zenarmor is open source and keeps routing. Secrotec is the official Zenarmor partner in the Netherlands and an independent ISO 27001 Lead Auditor; below we compare both objectively, with sources.

Zenarmor vs Meraki at a glance

Cisco Meraki information is based on public Meraki and Cisco documentation (checked October 2026). Prices are indicative, excluding VAT and subject to change; reseller prices vary.

Criterion	Zenarmor (via Secrotec)	Cisco Meraki MX
Architecture	Software on OPNsense, pfSense CE, FreeBSD, Ubuntu, Debian, Docker and more; on any suitable x86 hardware or VM	Meraki MX appliances, managed through the Meraki cloud dashboard
Licensing model	Per user per month; one licence covers 2 actively used devices; first site included, extra sites $50/month	Per device and per model, in Enterprise, Advanced Security or Secure SD-WAN Plus editions; co-termination, per-device (PDL) or subscription; one model per organisation
Application control	5,000+ applications, dynamic app database	Layer 7 application enforcement (NBAR) in all editions
Web filtering	300+ million websites in 120+ categories; Safe Search and YouTube Restricted Mode	Content filtering powered by Cisco Talos (Advanced Security or higher)
TLS inspection	Lightweight or full (decrypt/re-encrypt), 80+ predefined bypasses	No TLS decryption for content filtering: HTTPS is classified at domain level only
Threat protection	Cloud threat intelligence, Essential and Advanced categories, IPS, DNS deep inspection, real-time anti-phishing	IDS/IPS, malware protection (AMP), geo-IP firewall (Advanced Security)
ZTNA / remote users	Endpoint agents (Windows, macOS, Linux, Android, iOS), mesh VPN, device posture checks	Client VPN in all editions; zero trust and cloud security via separate Cisco products
SSE / CASB	Zenarmor SSE: cloud access rules per action (upload, download, share, delete); no content-aware DLP (roadmap)	Not part of the MX licence
Central management	Zenconsole: multi-tenant, policy import and backup, audit trail, REST API	Meraki dashboard: very simple, zero-touch provisioning, one dashboard for the whole Meraki stack
Reporting & data residency	Local, to your own SIEM/syslog, or cloud reporting with region choice incl. the Netherlands and Germany	Meraki cloud; Cisco cites globally distributed data centres, with EU regions in its subprocessor overview
High availability	Gateway HA (OPNsense, from Business / Unified Secure)	Warm spare with a second MX
When the licence expires	The OPNsense firewall, routing and VPN are open source and not tied to a subscription; paid Zenarmor features lapse	Co-term/PDL: after a 30-day grace period devices stop passing client traffic; dashboard limited to licence and device status
Hardware lock-in	No: licensed per user, free choice of hardware and hypervisor	Yes: licence per MX model, management only through the Meraki cloud
SD-WAN	Multi-WAN failover and load balancing via OPNsense; Zenarmor SD-WAN in development (roadmap)	Strong: Auto VPN and SD-WAN in all editions; analytics and smart breakout in Secure SD-WAN Plus
Indicative price	Unified Secure from $5.00 per user/month (min. 10); Unified Secure Plus from $9.00	MX75 Advanced Security licence: $763 street price at a US reseller (list $1,661), ≈ €687 per year at 1 USD = €0.90 (working assumption), plus hardware

Meraki/Cisco sources: MX licence editions, content filtering, licensing FAQ, Meraki Trust (checked October 2026). Zenarmor sources: plans and pricing, platforms, roadmap.

Meraki licence expired: what exactly happens?

For many organisations this is the reason to look for a Meraki alternative. According to the page Co-Term License Problem - Out of Compliance, it works like this:

1. Out of compliance: an organisation falls out of compliance when it is under-licensed or when the co-termination date is reached.
2. 30-day grace period: the organisation continues to operate normally for 30 days; administrators receive weekly email reminders.
3. Shutdown: after that, the organisation is shut down. Devices no longer pass client traffic, only Meraki management traffic.
4. Limited dashboard: only the License Info and Device Status pages remain accessible until compliance is restored. A one-time grace period reset is available as a courtesy.

The Meraki licensing FAQ confirms that hardware on co-termination and PDL licensing then becomes non-operational and no longer allows traffic to pass to the internet. For the newer subscription model, that FAQ does not explicitly describe expiry behaviour, so check your own agreement.

Practical advice: note your co-termination date, start renewing or migrating 90 days ahead and never let it reach the grace period. If you are considering a switch, plan the cut-over well before the end date.

Features compared

TLS inspection: the biggest functional difference

According to Meraki, content filtering can only classify and block domains, not full URLs, when HTTPS is in use; the browser then shows an error page instead of the Meraki block page. Because most web traffic is encrypted, an MX sees little of what happens inside a session. Zenarmor offers full TLS inspection (decrypt/re-encrypt) or a lightweight, certificate-based mode, with exceptions for banking and healthcare, for example. This requires careful design around privacy and employee representation; read our article on TLS inspection and GDPR.

Application control and web filtering

Meraki offers Layer 7 application enforcement in all editions and Talos-based content filtering from Advanced Security upwards. Zenarmor recognises 5,000+ applications and ties policies to users and groups (Entra ID, Google Workspace, Okta, SAML 2.0), VLANs, device categories and time schedules. See application control and the Zenarmor web filter.

Remote workers and ZTNA

An MX protects the traffic that passes through the MX; remote workers connect through Client VPN, or you buy separate Cisco products for zero trust and cloud security. Zenarmor agents enforce the same policy on laptops and phones wherever the user is, with mesh VPN and device posture checks. Unified Secure Plus includes two agents per user.

SD-WAN: where Meraki is stronger

To be fair, Auto VPN and SD-WAN are a core strength of Meraki. Zenarmor SD-WAN (application-aware routing, dynamic path selection, WAN aggregation) is on the roadmap and in development. Today, OPNsense covers most SME needs with multi-WAN failover and load balancing plus site-to-site VPN, but if application-aware path selection across many branches is critical right now, Meraki is ahead.

Management: Meraki dashboard versus Zenconsole

The Meraki dashboard is arguably the simplest network management on the market: zero-touch rollout, automatic firmware updates and MX, switches and Wi-Fi in one interface. Zenarmor's Zenconsole is a multi-tenant cloud portal with central policies, backup, an audit trail and, since version 2.7, cloud reporting with region choice, including the Netherlands and Germany.

Importantly, you do not have to replace everything. Meraki switches and access points can stay; only the MX gateway moves to OPNsense with Zenarmor. Bear in mind that Auto VPN only works between Meraki devices; during a phased migration you connect Zenarmor sites to the remaining MX appliances using standard IPsec.

Licensing and 3-year TCO

Meraki licenses per device, per model and per edition. According to Meraki, upgrading from Enterprise to Advanced Security within a co-termination organisation shortens the remaining term of the MX licences proportionally. Zenarmor licenses per user, and you choose the hardware. Assumptions below: Zenarmor list prices and a US street price for the Meraki licence, converted at 1 USD = €0.90 (working assumption), excluding VAT, without partner discount. These are worked examples, not quotes.

Example 1: around 25 users, one office

Cost item (3 years)	Cisco Meraki	Zenarmor
Hardware	MX appliance (price via a Cisco partner)	Reuse x86/VM (€0) or Deciso DEC740 €978
Security licence	Advanced Security, e.g. MX75: 3 × $763 = $2,289 ≈ €2,060	Unified Secure: 25 × $5 × 36 = $4,500; with the 25% 3-year prepay reduction $3,375
TLS inspection	Not available on the MX	Add-on $3/user/month or Unified Secure Plus ($6,075 after prepay reduction)
Indicative total	≈ €2,060 + hardware	≈ $3,375 to $6,075 + any hardware

Conclusion: on licence cost, a Meraki MX for one office is still cheaper (≈ €2,060 against ≈ $3,375, roughly €3,040), but the gap is smaller than often assumed: Meraki always adds MX hardware, while Zenarmor can run on existing hardware. At Cisco's list price ($1,661 per year) the MX licence is actually more expensive. What you do not get on the MX is TLS inspection, and your network depends on timely renewal.

Example 2: around 100 users, three sites, hybrid working

Cost item (3 years)	Cisco Meraki	Zenarmor
Gateways	Three MX appliances, each with an Advanced Security licence (MX75 class: 3 × ≈ €2,060 = ≈ €6,180) plus hardware	Reuse, or Deciso DEC850 €1,648 + 2 × DEC740 €978
User layer	Client VPN, or separate Cisco services for zero trust and cloud security (quote)	Unified Secure Plus: 100 × $8 × 36 = $28,800; with 25% prepay reduction $21,600
Extra sites	Extra MX + licence per site	2 × $50 × 36 = $3,600
Included	IDS/IPS, AMP, Talos filtering, Auto VPN/SD-WAN	200 agents, full TLS inspection, mesh VPN, site-to-site, gateway HA, Zenconsole
Indicative total	≈ €6,180 + hardware + user layer	≈ $25,200 before partner discount

Conclusion: comparing gateway licences alone is comparing apples with oranges. If domain filtering in the office is all you need, Meraki is clearly cheaper at street price. If you need full TLS inspection and protection for remote workers, compare Zenarmor with Meraki plus the separate Cisco security layer. For reference: in Zenarmor's own customer story about De Hooge Waerder, Zenarmor SSE for 235 users cost around €29,000 per year at list price, against an enterprise quote of €200,000 per year for ZTNA alone (Zenarmor's figures; Secrotec is quoted in that story as an ISO 27001 Lead Auditor and Zenarmor partner). More figures: Zenarmor price comparison 2026.

Compliance: ISO 27001, NIS2 and TISAX

Zenarmor does not make you compliant, but it does produce evidence. Secrotec is both auditor and implementer and configures Zenarmor to match what an auditor asks for.

• ISO 27001:2022: A.8.20 (network security), A.8.22 (segregation of networks), A.8.23 (web filtering), A.8.15/A.8.16 (logging and monitoring). See our ISO 27001 audit.
• NIS2: Article 21 requires risk-based measures including network security and monitoring; the Dutch Cyberbeveiligingswet has been in force since 15 August 2026. See NIS2 preparation and our guide to network segmentation.
• TISAX®: VDA ISA 5.2.3 (malware protection) expects inspection at the gateway, including encrypted traffic; 5.2.7 (network management) and 2.1.4 (remote work) call for segmentation and secured access. Without TLS inspection, 5.2.3 is harder to demonstrate. Control numbers follow VDA ISA 6 and may shift in ISA2027. Secrotec supports TISAX readiness; the assessment is carried out by an ENX-approved audit provider.
• GDPR: with reporting in the Netherlands or Germany, or fully local, log data containing personal data stays within the EU.

When is Cisco Meraki the better choice?

• You already run a full Meraki stack (MX, switches, Wi-Fi) and simplicity comes first.
• You have many branches without on-site IT and want zero-touch rollout.
• Application-aware SD-WAN across many sites is critical today.
• You are deeply invested in the Cisco ecosystem and want everything from one vendor.
• Domain-level filtering is sufficient and you do not need TLS inspection.

When is Zenarmor the better choice?

• You need full TLS inspection and URL-level filtering.
• You do not want an expired licence to be able to stop your internet traffic.
• Your staff work hybrid and security has to travel with the user.
• You want to choose your own hardware and reuse existing servers or VMs.
• You want reporting in the Netherlands or Germany, on-premises or in your own SIEM.
• Your co-termination date or the end of life of your MX is approaching.

See also Zenarmor beyond NGFW with SSE, ZTNA and CASB, the practical example on stopping WeTransfer uploads with SSE and CASB and our Firewall & Networks services.

Partner discount via Secrotec: send us your Meraki renewal quote

Secrotec delivers Zenarmor licences and projects throughout Europe and has satisfied Zenarmor customers across the European Union. You receive a partner discount, and in Zenarmor projects the price is always negotiable.

Send us your Meraki renewal quote or your co-termination date. We will make a fair comparison on equal scope, and we will tell you if Meraki remains the better choice for you. More information is on the Zenarmor partner page; ask your questions via contact.

Request a quote with partner discount

Disclaimer: Cisco, Cisco Meraki, Meraki and Talos are trademarks of Cisco Systems, Inc. and/or its affiliates; Zenarmor is a trademark of Sunny Valley Cyber Security Inc.; TISAX® is a registered trademark of the ENX Association. All other trademarks are the property of their respective owners. Prices and features are indicative, as of October 2026, excluding VAT and subject to change; reseller prices vary. This comparison is based on public sources and is intended as objective information.