Cisco SD-WAN licensing: tiers, costs & negotiation levers.
Cisco licenses SD-WAN per site on Catalyst subscription tiers — Essentials, Advantage, Premier — each tied to a bandwidth band, with Meraki MX licensed per device alongside. The tier and band you choose move the bill more than the site count does. This note maps the model and the levers that cut an over-provisioned renewal.
Cisco SD-WAN is licensed per site, with Catalyst running from about $250 a site each year at Essentials to roughly $1,000 at Premier. The most common overspend is standardising on Premier everywhere when only direct-internet sites need it. Matching tier and bandwidth band to each site's real role is the largest controllable saving — routinely worth a third off a mis-sized site group.
01 Key findings
Two platforms, two licensing models. Catalyst SD-WAN (IOS XE, router-based) licenses per site on tiered subscriptions; Meraki MX (cloud-managed) licenses per device. A single renewal often spans both, and each follows its own rules.
Tier and bandwidth band set the bill, not headcount. The tier fixes the feature set from Essentials to Premier; the bandwidth band fixes the per-site rate within the tier. Both are the controllable variables — site count is not.
Premier-everywhere is the default overspend. Integrated security at Premier is only needed at direct-internet-access sites; hub-backhaul sites can run Advantage or Essentials. Standardising on the top tier for simplicity is the costliest habit in a Catalyst estate.
Bandwidth bands accrete headroom. Sites provisioned for peak rather than typical throughput sit a band too high. Right-sizing bands against real utilisation at renewal routinely removes 10–15% with no change to service.
Timing is a negotiating lever. Migration double-running, DNA-subscription overlap and subscription start dates versus cutover all leak money that a disciplined renewal recovers.
02 Two licensing models
Cisco's SD-WAN portfolio runs on two distinct platforms that are licensed differently, and conflating them is the first source of confusion in any renewal. Catalyst SD-WAN, built on the IOS XE routing platform and managed through the Catalyst SD-WAN controllers, licenses per site on tiered subscriptions tied to a bandwidth band. Meraki MX, the cloud-managed security and SD-WAN appliance line, licenses per device on the Meraki subscription model covered in our Cisco Meraki pricing guide.
Many organisations run both — Meraki MX at smaller branches, Catalyst SD-WAN at larger sites — so an SD-WAN renewal often spans two licensing models at once. The negotiation has to address both rather than treating SD-WAN as a single line.
Catalyst SD-WAN suits larger, router-based sites needing advanced routing and granular control; Meraki MX suits smaller branches that benefit from cloud-managed simplicity. The platform is chosen per site, and the licensing follows whichever platform each site uses.
03 Tier & cost matrix
Catalyst SD-WAN licensing is built on per-site tiers — typically Essentials, Advantage and Premier — layered on a bandwidth band that reflects each site's throughput. The tier sets the feature set; the band sets the rate within the tier. Representative annual per-site list pricing at a midrange band:
| Tier | Capability | Bandwidth band role | Approx. list per site / year |
|---|---|---|---|
| Essentials | Core SD-WAN connectivity and policy | Sets rate within tier | $250–$400 |
| Advantage | Adds advanced routing and analytics | Sets rate within tier | $450–$700 |
| Premier | Adds integrated security and full feature set | Sets rate within tier | $800–$1,000+ |
The tier ladder is where the money sits. Buying Premier across every site for the integrated security — when only the direct-internet-access sites need it — is the most common overspend, while backhaul sites could run Advantage or Essentials. Matching the tier to each site's actual role, rather than standardising on the top tier, is the largest controllable saving in a Catalyst estate.
04 Cost at scale
At estate scale the per-site tier rate compounds fast. Representative annual per-site list, tier over tier:
Consider a 120-site estate provisioned entirely at Premier for integrated security, where only the 30 direct-internet-access sites need it and the 90 hub-backhaul sites could run Advantage. The tier-rationalisation saving:
| Site group | Count | Tier | Approx. annual |
|---|---|---|---|
| Direct-internet sites | 30 | Premier (hold) | ~$27,000 |
| Hub-backhaul sites (before) | 90 | Premier | ~$81,000 |
| Hub-backhaul sites (after) | 90 | Advantage | ~$54,000 |
Moving the 90 backhaul sites from Premier to Advantage recovers roughly $27,000 a year — a 33% cut on that group, drawn entirely from matching the tier to each site's role. Layering bandwidth-band right-sizing on top compounds the saving further, which is why both reviews belong in the same renewal.
05 The tier & renewal trap
Two structural traps quietly inflate a Catalyst renewal, and both are invisible until utilisation data is pulled per site.
Each per-site licence is tied to a bandwidth band, and sites provisioned for peak rather than typical throughput sit in a higher band than their real traffic requires. Bands are reviewed at renewal; a site whose actual utilisation runs well below its provisioned band is paying for headroom it never uses. Pulling utilisation data before the renewal and right-sizing bands down where traffic supports it routinely removes 10–15% from a Catalyst renewal, with no change to service.
SD-WAN usually replaces an MPLS or legacy WAN estate, and during the transition the old circuits and the new subscriptions run in parallel until every site cuts over. A migration that drifts across quarters pays for both, and that overlap frequently exceeds the SD-WAN saving for its duration. Compress the timeline, and negotiate subscription start dates to align with cutover rather than contract signing — the vendor prefers the clock to start at signing.
06 Term, DNA & controllers
SD-WAN subscriptions are sold on terms from three to seven years, and as across the rest of the Cisco estate the longer term carries a deeper discount. The SD-WAN licence also interacts with the on-premises Catalyst licensing managed through DNA Center, because the routing platform that runs SD-WAN frequently carries its own DNA subscription. The two should be reconciled so you are not paying twice for overlapping capability — our guide to Cisco DNA Center pricing covers the on-premises model that pairs with SD-WAN, and the broader Cisco licensing guide places it within the full subscription portfolio.
Catalyst SD-WAN also runs on a control plane of management, orchestration and validation components. Cisco offers these controllers cloud-hosted or self-hosted; the cloud-hosted option folds the control plane into the subscription, self-hosting trades operating burden for control. Either way, the per-site subscription assumes a control plane, so the hosting decision is part of the total SD-WAN cost rather than a separate line. For larger estates, SD-WAN is also a candidate to fold into a Cisco Enterprise Agreement — the same bundle-versus-standalone call examined in Cisco EA pricing and Cisco EA versus a la carte.
07 Licensing framework
Four factors drive whether an SD-WAN estate is sized to what it runs or to headroom it never uses. Weight them to your estate before the renewal.
Site role
Direct-internet sites need Premier's integrated security; hub-backhaul sites can run Advantage or Essentials. Map each site's role before standardising on a tier.
Real utilisation
Pull per-site throughput data. Sites sitting below their provisioned bandwidth band are the candidates to right-size down at renewal, without touching service.
Overlap & timing
Reconcile SD-WAN against DNA subscriptions and any SASE cloud-security layer, and align subscription start dates with cutover to kill migration double-running.
Bundle vs standalone
Term length and the EA fold both deepen discount but commit you across Cisco. Weigh the blended per-site rate against the flexibility you give up.
08 Our recommendation
Sites that backhaul through a regional hub for security rarely need more than core connectivity and policy. Default them to Essentials and right-size the band to typical, not peak, throughput.
Sites needing advanced routing and analytics but not branch security. This is where most estates over-buy into Premier — the single largest tier-rationalisation saving usually lands here.
Hold Premier for direct-internet-access sites that genuinely use the integrated security. Reconcile it against any SASE cloud-security subscription so branch security is paid for once, not twice.
09 Cutting the renewal
The SD-WAN renewal responds to three levers: tier rationalisation by site role, bandwidth-band right-sizing against real utilisation, and term commitment for the stable portion of the estate. Because SD-WAN is sold through Cisco partners, partner margin is also in play, and a competitive quote tests it. The structured approach in our software contract negotiation guide applies directly, and a review through our software licensing advisory service models the per-site tiers, the bandwidth bands and the EA alternative together. An estate renewed at its provisioned tiers and bands pays for headroom it does not use; an estate renewed against real utilisation pays for what it runs.
Renewing an SD-WAN estate?
We model the per-site tiers, bands and term, and negotiate the renewal against the EA alternative — buyer-side only.
The Licensing Edge
Weekly vendor and licensing intelligence for enterprise IT leaders. 3,000+ subscribers.