Meraki MX End of Support: MX64, MX65 and MX84 Dates

The Cisco Meraki MX65 passed its end-of-support date on 28 May 2026. The MX84 follows on 31 October 2026, the MX100 on 1 February 2027 and the widely deployed MX64 on 26 July 2027. The standard MX67 and MX68 are not on the end-of-life list.

For a cloud-managed appliance, the question that matters is what happens on that date. Cisco's policy is short: "Product lifetime ends concurrently with product end-of-support (EOST) date." From that day, Meraki "may no longer issue firmware updates or patches" for the model and will not replace a failed unit, even if its licence runs for years. The box usually keeps passing traffic. It just stops being maintained.

Meraki MX end-of-life dates

Meraki lists three milestones per product: the end-of-sale announcement, the end-of-sale date (last order) and the end-of-support date, which is typically five years after end of sale. These are the MX appliances most common in mid-market branch networks.

Source: Cisco Meraki, End-of-Life (EOL) Products and Dates.

Two things are easy to misread. The MX67 and MX68 are not end of life; only the variants with a built-in cellular modem are. Cisco is moving cellular to separate MG gateways. And the MX84 date is close enough that any unit still in production needs a decision before the end of this month. The cross-vendor end-of-life tracker puts these dates next to Fortinet, SonicWall and Sophos.

What happens to a Meraki MX on its end-of-support date?

On the end-of-support date, the MX does not switch off. With a valid licence it typically keeps routing, filtering and holding its Auto VPN tunnels, and it stays visible in the dashboard. What ends is the vendor's side of the deal: hardware replacement, technical support and, in Cisco's words, firmware updates and patches.

That distinction is where most confusion comes from. A Meraki MX has two separate clocks. The licence decides whether the box works at all. The end-of-support date decides whether anyone maintains it.

Cisco's RMA page puts the hardware side plainly: product lifetime ends at the end-of-support date, and "a warranty is not the same as a license." A licence running until 2029 does not buy a replacement for an MX65 that dies in 2026. Administrators on r/meraki confirm that Meraki will sell licences for end-of-support gear but will not replace it if it fails.

The software side is less absolute than many pages suggest, but not reassuring either. Meraki's policy says it "may no longer" issue firmware or patches after end of support, and that new dashboard features may not work with legacy hardware. Its firmware policy adds that some end-of-sale hardware has a maximum firmware version. Before end of support, engineering fixes for an old firmware line are limited to critical security vulnerabilities. After it, there is no commitment at all.

Cisco also does not guarantee the cloud connection indefinitely. Its policy says legacy products "typically" can connect to the management cloud for their useful life. If that connection ends, Cisco offers an upgrade path or a prorated credit for remaining licence time.

For a firewall on the internet edge, "keeps working but receives no fixes" is the risky state. Under NIS2, Article 21 expects vulnerability handling and basic cyber hygiene. In Belgium, CyFun asks for security updates at every assurance level. An MX65 or MX84 past its date is hard to defend in either audit, whatever the dashboard shows.

Why licensing decides the timing

The licence model is often what decides when you can refresh, more than the hardware date. Meraki sells MX licences under two main models, and they behave very differently when you retire hardware.

Co-termination. All licences in the organisation pool into one shared expiry date. Adding or removing devices moves that date for everyone. When the co-term date passes without renewal, a 30-day grace period starts in which nothing changes for users. After those 30 days, Meraki's documentation states that all Meraki devices in the organisation are shut down and the dashboard shows only the licence page.

Here is the worked example that matters for a refresh. Take an organisation with twelve branches on MX64s and one co-term date in 2028. It replaces three branches with newer appliances this year. The time left on those three MX64 licences stays in the pool rather than coming back as a refund, and the new appliances need licences of their own tier. The other nine MX64s keep running on a pool that now has to cover them until July 2027, after which they are end of support but still licensed. The organisation pays to keep unsupported hardware licensed, or brings the refresh forward.

Per-device licensing. Each licence belongs to one device. When it lapses, only that device stops after the grace period. That isolates risk, but moving value to a new model is not automatic, because licence tiers differ by appliance class. Cisco is also moving customers towards subscription licensing for new purchases.

The practical step is the same under both models: line up the licence end date with the hardware date before you renew. Renewing a co-term pool for three years while a third of the estate reaches end of support in ten months is the most common way organisations end up paying for boxes they no longer want.

The successors: what you gain and what you pay

Meraki's end-of-life page does not name a successor per model. In practice, branches move to the current models of the same class: the MX67 or MX68 for small sites, the MX75 for sites with a gigabit line, the MX85 for larger branches and the MX95 at the top of the range.

Source: Cisco Meraki MX Sizing Principles and MX datasheets. "Prevention" and "Detection" are Meraki's NGFW inspection modes measured on mixed traffic; older datasheets report a single "advanced security" figure.

The gain is real. An MX64 or MX65 tops out at 250 Mbps of firewall throughput, which a modern fibre line easily exceeds once inspection is on. An MX75 handles a gigabit of firewalling and twice the VPN capacity of an MX84. Note what does not improve: the MX75 and MX85 have the same firewall and Prevention-mode figures, so a site that outgrows an MX75 on inspection needs an MX95.

The cost moves with the tier. The MX75 lists at about €1,800 ($1,959) and the MX85 at about €2,800 ($3,044) for hardware alone, and Meraki prices Advanced Security licences by appliance class, so the faster box also carries the larger recurring fee. Practitioners on r/meraki report that the licence, not the hardware, is the bulk of a multi-year MX75 quote.

Hardware prices: Cisco global list prices as indexed in September 2026, converted from USD; local EUR pricing and partner discounts differ.

Cisco also sells the Secure Router 8000 series (C8111-G2-MX and C8121-G2-MX), which run MX OS in the same dashboard with multi-gigabit WAN ports. They need their own new licences and are an alternative within the MX family rather than a named replacement.

What staying on an end-of-support MX costs

Keeping an MX64 or MX84 past its date looks free. It is not.

• No replacement on failure. A failed unit is an outage until you buy and ship new hardware, at a time you did not choose.
• Licences for unmaintained hardware. Meraki accepts licence renewals for end-of-support devices. You pay full price for management of a box that gets no fixes.
• No security patches you can count on. The policy allows Meraki to stop firmware entirely, so new vulnerabilities in an edge device stay open.
• Audit exposure. Under NIS2 and CyFun, an unmaintained perimeter device is a finding, and after an incident it is the first question.
• A co-term pool that drags. Every month an end-of-support unit stays in a co-term pool, it consumes licence time that could have gone to its replacement.

The firewall decommissioning checklist covers how to retire a unit cleanly once you decide.

Cisco's own SASE path for Meraki customers

Cisco's cloud option for Meraki estates started as Cisco Secure Connect, which connects MX sites to Umbrella data centres for secure internet access, cloud firewalling and, in the higher tier, remote access and ZTNA. Cisco now offers an upgrade from Secure Connect to Cisco Secure Access, its single SSE platform. The two cannot coexist in one Meraki organisation.

Two practical points come up in Meraki's own documentation. Tunnels to the secure internet access service must use an MTU of 1,280 bytes or less, because fragmented packets are dropped, which can disrupt applications that were never tuned for it. And the cloud service sits on top of the MX appliances rather than replacing them, so the branch still needs a licensed MX. Organisations that ran Umbrella's roaming client should also check the Umbrella roaming client end of life, which touches the same estate.

If you are weighing a refresh against a different architecture, now is a natural point to test it on one branch. You can try Jimber free without touching the rest of the estate.

When branch security should move off the appliance

A hardware refresh still fits some estates. Static branches with on-site servers, little remote work and a full Meraki stack of switches and access points benefit from one dashboard and zero-touch rollout. For them, the MX75 or MX85 is the predictable choice.

Many mid-market branches look different. Users work partly from home, most applications are SaaS, and the MX mainly does three jobs: internet filtering, site-to-site VPN back to head office and remote access. For those sites, moving inspection to the cloud means the branch edge only forwards traffic, policies follow the user wherever they connect, and the next refresh is not tied to a throughput ceiling.

That is where the Meraki argument for simplicity carries over. The same simplicity is available without appliance lock-in or a co-term pool: Jimber combines SD-WAN, ZTNA, a secure web gateway and firewall-as-a-service in one European platform, with data handled in the EU. The commercial comparison is in Cisco Meraki versus Jimber SASE. The site-to-site part is in the SD-WAN guide, and for IT service providers managing several customer estates, managed SD-WAN for service partners covers the multi-tenant side.

The case for staying with Meraki

A satisfied Meraki customer will make three fair points.

"One dashboard runs my whole network." Firewalls, switches, access points, cellular gateways and cameras in one place is a genuine advantage for a small team. Moving the firewall elsewhere means a second console. The honest answer is that the switches and access points can stay in Meraki; the question is only whether the security function needs to sit in the branch box.

"Auto VPN just works." It does. Meraki builds and maintains the mesh between sites with almost no configuration, even on dynamic addresses. Any alternative has to match that, and branches that exchange a lot of traffic directly with each other, such as plants talking to an on-site inventory system, may be best served by keeping it.

"Our Cisco agreement makes the refresh cheap." Organisations buying through an enterprise agreement get substantial discounts and an existing supplier relationship. That changes the hardware price. It does not change the recurring licence, the next end-of-support date five years on, or the question of whether the branch still needs inspection on site.

Conclusion

The Meraki MX end-of-support dates are not a shutdown. They are the point after which an edge firewall is no longer maintained, while the licence keeps billing. Check every MX65 and MX84 now, line up licence and hardware dates before the next renewal, and decide per site whether the branch needs a bigger box or a lighter edge with security in the cloud.

If the cloud route fits some of your sites, Try Free on one branch. Or book a demo and we will go through your MX estate together.

Frequently asked questions

Does a Meraki MX stop working on its end-of-support date?

No. With a valid licence it typically keeps routing traffic and stays in the dashboard. What ends is hardware replacement and technical support, and Meraki may stop firmware updates and patches. Cisco does not guarantee the cloud connection indefinitely, but states legacy products typically connect for their useful life.

When is the Meraki MX64 end of life?

The MX64 and MX64W reached end of sale on 26 July 2022 and reach end of support on 26 July 2027. After that date Meraki no longer replaces failed units and may stop issuing firmware for them.

What is the Meraki MX65 end-of-support date?

28 May 2026. The MX65 and MX65W are already past end of support, so a failed unit will not be replaced under warranty, even if its licence is still valid.

Are the Meraki MX67 and MX68 end of life?

No. The standard MX67, MX67W, MX68 and MX68W have no end-of-sale date. Only the cellular variants MX67C and MX68CW were announced on 27 August 2026, with end of sale on 27 November 2026 and end of support on 30 November 2031.

When does the Meraki MX84 reach end of support?

On 31 October 2026. After that date, hardware replacement and support end. Sites still running an MX84 need a replacement or a different architecture planned now, before a failure forces the decision.

What happens when a Meraki licence expires?

A 30-day grace period starts in which users notice nothing. After that, Meraki shuts down the devices and the dashboard only shows the licence page. Under co-termination this applies to the whole organisation; under per-device licensing only to the unlicensed device.

Can I renew a licence on an end-of-support MX?

Yes. Meraki accepts licences for end-of-support hardware, but the licence only keeps the device managed in the dashboard. It does not restore warranty, hardware replacement or a commitment to security patches.

What replaces the Meraki MX64 and MX65?

Meraki does not name an official successor. Small sites typically move to the MX67 or MX68 (700 Mbps firewall); sites with a gigabit line to the MX75 (1 Gbps firewall). The alternative is to move branch security to a cloud platform and keep only a light edge device.

Is the MX75 worth the higher licence cost over an MX68?

Only if the site needs it. The MX75 adds firewall and VPN capacity for faster lines, but Meraki prices licences by appliance class, so the recurring cost rises with it. Size on the line speed with inspection enabled, not on the hardware price.