Cisco SD-WAN licensing: Catalyst, DNA & Viptela guide.
Cisco SD-WAN is a major budget line and a poorly understood one. This note maps the three platforms an enterprise inherits — legacy Viptela, current Catalyst SD-WAN, and cloud-managed Meraki — how each is licensed, what the DNA Software tiers actually cost, the migration and tier traps that inflate spend, and the levers that reduce renewals.
There is no single "right" Cisco SD-WAN buy. DNA Advantage is the correct tier for most large enterprises; Premier is unnecessary in roughly 60% of cases we assess. EA inclusion at 50+ sites cuts 25–40% versus standalone subscriptions. The single highest-value move is to benchmark against VeloCloud or Fortinet before every renewal — worth 10–15 points of additional discount even with no intent to switch.
01 Key findings
Two platforms, three lineages — buy the wrong one and you own a multi-year migration. Legacy Viptela folds into Catalyst SD-WAN for large complex WANs; Meraki SD-WAN serves cloud-managed mid-market branches. They are not interchangeable, and mixing without an architecture rationale is expensive.
DNA Advantage is the default, not Premier. Premier's SASE stack duplicates existing Zscaler or Palo Alto spend in most enterprises. Over-buying Premier typically costs $60–$120 per device per year in unnecessary uplift.
ThousandEyes bundling frequently justifies the tier uplift on its own. Standalone value at 100 sites exceeds $60,000–$96,000 per year, and it deploys at no incremental cost inside Advantage.
EA inclusion is the single most impactful decision above ~50 sites. EA DNA Software runs 25–40% below catalogue versus 15–25% standalone, plus True Forward predictability and growth-suite rights.
Competitive tension is the cheapest discount you can buy. A formal VeloCloud or Fortinet evaluation, even without switching intent, consistently drives Cisco discount authority up 10–15 points.
02 The three platforms
Cisco's SD-WAN portfolio spans three lineages: the original Viptela acquisition, its rebranded successor Catalyst SD-WAN, and the separately-acquired Meraki line. Viptela and Catalyst are one continuous platform; Meraki is a distinct product for a different segment.
| Dimension | Viptela (legacy) | Catalyst SD-WAN | Meraki SD-WAN (MX) |
|---|---|---|---|
| Heritage | Viptela acquisition (2017) | Rebrand of Viptela stack | Meraki acquisition (2012) |
| Management | vManage | Cisco SD-WAN Manager | Meraki Dashboard (cloud) |
| Target market | Early enterprise adopters | Large enterprise, complex WAN | Mid-market, distributed branches |
| Licensing model | Being retired to Catalyst | DNA Software tiers per device | Per-device licence (MX, Z-Series) |
| Policy complexity | High, granular | Very high, granular segmentation | Moderate, template-driven |
| Multi-cloud | Native | Native (AWS, Azure, GCP) | Limited (Meraki AutoVPN) |
| EA integration | Migrates into Network track | Yes, Network / Combined track | Limited, separate Meraki pricing |
Most Fortune 500 environments deploy Catalyst SD-WAN for headquarters and major sites, sometimes supplemented by Meraki at smaller branches. For broader context, see our Cisco Licensing Complete Guide and Cisco Meraki Licensing.
03 DNA Software tiers
Catalyst SD-WAN capability is licensed through Cisco DNA (Digital Network Architecture) Software. Since Cisco discontinued perpetual networking software in 2022, all Catalyst SD-WAN deployments require active DNA subscriptions. Three tiers exist, priced per device per year for ISR 1000/4000 and ASR 1000 class hardware.
| Tier | Core capability | Adds over lower tier | Typical price / device / yr |
|---|---|---|---|
| DNA Essentials | App-aware routing, vQoS, basic segmentation, VPN fabric, Zero-Touch Provisioning, vManage | Baseline SD-WAN | $85–$120 |
| DNA Advantage | Full SD-WAN — most commonly purchased tier | vAnalytics, ThousandEyes WAN Insights, advanced/micro-segmentation, APIC-EM, Encrypted Traffic Analytics | $160–$220 |
| DNA Premier | Complete stack with integrated SASE | Cisco Umbrella SIG, DNS-layer security, CASB, SD-WAN security as a service | $240–$320 |
Premier over-buying is the most expensive single mistake. Its SASE features compete directly with Zscaler, Palo Alto Prisma and Netskope — vendors most large enterprises already run independently. Before buying Premier, audit whether the security capability replaces existing SSE spend or simply duplicates it. In roughly 60% of enterprise cases we assess, DNA Advantage is the appropriate tier and Premier represents unnecessary cost.
04 Tier pricing at a glance
Indicative DNA Software list pricing per device per year (upper-bound of typical range). The gap between Advantage and Premier is where most avoidable overspend sits — model ThousandEyes value into the Essentials-to-Advantage step, and existing SSE spend into the Advantage-to-Premier step.
Meraki SD-WAN prices separately in tiered bundles — Enterprise ($2,800–$4,200), Advanced Security ($4,200–$6,500) and Secure SD-WAN Plus ($5,500–$8,000) per MX250 on a 3-year term — with 25–45% reseller discounts available on 3- or 5-year co-terming.
05 Viptela to Catalyst migration
Enterprises still running the legacy Viptela stack under vManage are being moved to Catalyst SD-WAN and Cisco SD-WAN Manager. The platform is continuous, but the licensing model is not: perpetual and older subscription entitlements convert to current DNA Software tiers, and the conversion is a negotiation event, not a formality.
Don't let a rebrand become a re-buy at list. Migration from legacy Viptela or from MPLS-centric architectures qualifies for competitive-displacement and migration credits of 10–20% of first-year contract value. Cisco has specific programmes for these scenarios, and the credits are routinely left on the table by buyers who don't ask explicitly. Align the migration with a hardware refresh where possible — bundled ISR/ASR-plus-DNA orders capture better software discounts than renewals on existing hardware.
06 EA inclusion & ThousandEyes
The single most impactful licensing decision for large deployments is whether to fold SD-WAN into a Cisco Enterprise Agreement. The EA Network track (or Combined track) encompasses DNA Software across switching, wireless and SD-WAN in one commercial framework.
| Dimension | Standalone subscription | EA inclusion (Network / Combined) |
|---|---|---|
| DNA Software discount | 15–25% below catalogue | 25–40% below catalogue |
| Adjustment model | Per-order true-up | True Forward — adjusts up only, never down |
| Branch expansion | Per-device purchase orders | Growth-suite rights — deploy without new POs |
| Break-even | Below ~50 sites | Typically reached at 50+ SD-WAN sites |
ThousandEyes is the hidden value driver. Acquired in 2020 and integrated into DNA Advantage, it monitors WAN path performance, ISP and cloud-provider health, BGP visibility and application experience. Standalone pricing runs $50–$80 per agent per month ($600–$960 per site per year); at 100 sites standalone value exceeds $60,000–$96,000 annually. Bundled at no incremental cost in Advantage, it materially strengthens the Essentials-to-Advantage justification — always model it explicitly.
07 Decision framework
Four considerations drive the platform and tier decision. Weight them to your estate before committing to a renewal.
Platform fit
Complex, high-throughput, multi-cloud WANs favour Catalyst SD-WAN; distributed retail or branch estates of 200–2,000 moderate-complexity sites often achieve better TCO on cloud-managed Meraki.
Existing security stack
If Zscaler, Palo Alto Prisma or Netskope already deliver SSE, Premier duplicates that spend. Advantage is the right tier unless Premier genuinely consolidates existing SASE contracts.
Site count & trajectory
Above ~50 SD-WAN sites, EA inclusion delivers deeper discounts and growth-suite rights. Below that, standalone subscriptions usually beat EA administrative overhead.
Observability need
If network observability is on the roadmap, ThousandEyes bundling in Advantage frequently justifies the tier uplift on its own — quantify standalone value before deciding.
08 Our recommendation
Large, complex, multi-cloud WANs. Standardise on DNA Advantage, capture ThousandEyes value, and resist the Premier upsell unless it genuinely replaces existing SSE spend.
Distributed retail, hospitality or branch estates prioritising cloud-managed provisioning over deep policy control. Push 3- or 5-year co-terming for 25–45% reseller discounts.
Fold SD-WAN into the Network or Combined track for 25–40% discounts, True Forward predictability and growth-suite rights — especially alongside Catalyst switching and DNA Center.
09 Negotiation & renewal levers
Cisco SD-WAN is a highly negotiable category and the 2026 market is more contested than ever. The levers that move renewal pricing:
Benchmark & consolidate Recommended
Run a formal VeloCloud or Fortinet evaluation before every renewal — worth 10–15 points even with no switching intent. Fold SD-WAN into the EA for 30–40% floors, commit 3–5 years for 15–25% more, and claim migration credits explicitly.
Accept the renewal quote Weaker
Renew annually at standalone list, over-buy Premier, and skip benchmarking. This is the default path that leaves 25–38% on the table — the norm rather than the exception across the contracts we review.
See our Cisco DNA Software Guide for tier-level detail and Cisco Audit Defence for Smart Licensing compliance risk.
Stop overpaying for Cisco SD-WAN
Our advisors right-size DNA tiers, structure EA inclusion and benchmark against the market — typically reducing Cisco SD-WAN cost by 25–38%.
The Licensing Edge
Weekly cloud and licensing intelligence for enterprise IT leaders. 3,000+ subscribers.