Cisco Meraki MS220-48LP EoL: Migrate to the MS225-48LP

If you still have Cisco Meraki MS220-48LP switches (PID MS220-48LP-HW) humming away in wiring closets, they are now past every Meraki lifecycle milestone that matters. The MS220-48LP reached its Last Day of Support on July 29, 2024. From that date forward Cisco/Meraki provides no firmware fixes, no security patches, and no advance-replacement RMA for this model. The switch keeps forwarding frames and keeps powering phones and access points, which is exactly why these units quietly persist long after they should have been retired. This guide explains what the end-of-life dates actually mean for a live access layer, why the recommended MS225-48LP is a genuine upgrade rather than a like-for-like swap, and how to plan a low-risk refresh.

What the MS220-48LP actually was

The MS220-48LP is a 48-port Gigabit, Layer 2, cloud-managed access switch. The "LP" denotes Low Power, partial PoE: it carries 802.3at PoE+ capability across the ports but with a single 370W power budget, so it can power a subset of ports at full PoE+ rather than all 48 simultaneously. Uplinks are 4x 1G SFP. Switching capacity tops out around 100 Gbps with a non-blocking 1G access layer, and it is managed entirely from the Meraki dashboard with no CLI. Stacking on the MS220 line is virtual only (dashboard grouping), not a physical data-plane stack. For 2014-era access closets feeding phones, badge readers, and a handful of 802.11n/ac access points, it was a clean, low-touch switch. Against today's PoE loads and 10G aggregation expectations, it is a bottleneck with no support floor.

Why acting now matters

The hazard of an EoL switch is not that it stops working. It is that it keeps working while the support floor disappears beneath it. Three concrete exposures stack up after LDoS:

• No PSIRT security patches. When a new switching or Meraki firmware vulnerability is disclosed, the MS220-48LP will not receive a fixed build. Its firmware train is frozen. Any CVE affecting that code path on this hardware is permanent, and because the device phones home to the Meraki cloud, an unpatchable management agent is a real attack surface, not a theoretical one.
• No TAC support or RMA. A dead unit cannot be advance-replaced under contract, and you cannot open a supported case to troubleshoot it. Your only recovery is a spare you stockpiled before LDoS or a gray-market unit of the same dead-end model.
• Audit and compliance exposure. The frameworks federal, DoD, SLED, and healthcare buyers live under (FedRAMP, CMMC, HIPAA Security Rule, PCI DSS, and CISA directives) expect supported, patchable infrastructure. An unsupported switch that cannot be patched is a finding waiting to happen, and "the vendor no longer ships fixes" is not a defensible remediation plan.

There is also a licensing trap unique to Meraki. The hardware is inseparable from a dashboard subscription. When an MS220 license lapses on an EoL device, you cannot renew it indefinitely on a platform Meraki has retired, so the clock on the cloud entitlement and the clock on hardware support converge. The switch and its license age out together.

What each milestone means in practice

• End of Sale (2017-07-29): the last day Meraki accepted new orders for the MS220-48LP. Everything after this date has been consuming the support tail.
• Last Day of Support / LDoS (2024-07-29): the final day of any firmware fixes, security patches, and hardware replacement. After this date the device is unsupported in every sense, regardless of whether it is still passing traffic.

The recommended replacement: Meraki MS225-48LP

The direct successor is the Cisco Meraki MS225-48LP (PID MS225-48LP-HW), a 48-port Gigabit, Layer 2, stackable cloud-managed switch. It deliberately preserves the things that made the MS220 easy (same 48x GbE access density, same 802.3at PoE+ with a 370W budget, same single-pane Meraki dashboard, same lifetime hardware warranty) while fixing the two structural limits of the older platform: uplinks and stacking.

Concretely what is better

• Uplinks jump from 4x 1G SFP to 4x 10G SFP+. That is a 10x increase in northbound capacity to your distribution or core, which is the difference between an access closet that can feed Wi-Fi 6/6E access points and one that throttles them at the wire.
• True physical stacking. The MS225 supports dedicated data-plane stacking at up to 80 Gbps, so multiple switches act as one logical unit with a single management point, cross-stack link aggregation, and resilient uplinks. The MS220's "stacking" was virtual dashboard grouping only.
• Higher switching capacity. The MS225 roughly doubles forwarding capacity versus the MS220 generation, giving real non-blocking headroom across 48 ports plus 10G uplinks.
• A current, TAA-compliant SKU. A TAA-compliant MS225-48LP option is available, which matters for federal and DoD builds where country-of-origin documentation is mandatory. The MS220 has no clean compliant path because it is end-of-life.

If your closet only needs simple non-stacked access and budget is tight, the MS120-48LP is the lighter-weight alternative; it matches port count and 370W PoE but keeps 1G uplinks and drops physical stacking. For most refreshes, the MS225-48LP is the right floor because the 10G uplinks and stacking are what carry the design forward into a Wi-Fi 6/6E and multi-gig client world. You can compare current Meraki access-layer pricing in our catalog before you settle the BOM.

A practical migration plan

1. Assessment and inventory

Pull a switch-port report from the Meraki dashboard for every MS220-48LP: port count in use, PoE draw per port and per switch (confirm you are inside the 370W budget today and after refresh), VLAN assignments, native and tagged VLANs on uplinks, link aggregation groups, and any access policies or sticky-MAC settings. Note the firmware version and the license expiry date for each unit. This inventory becomes your config-parity checklist.

2. License transition

Meraki licensing is per-device and tied to your dashboard organization, sold as an Enterprise or Advanced subscription term per switch. When you claim MS225-48LP serials into the org, plan the subscription term up front and confirm co-termination so all licenses share one renewal date rather than drifting. Do not let MS220 licenses auto-renew on hardware you are retiring; align the new MS225 term to your fiscal calendar instead.

3. Config and feature parity

Because both platforms are Layer 2 and both run from the same dashboard, parity is straightforward. Recreate VLANs, access policies, port profiles, link aggregation, and any QoS or storm-control settings. Validate that PoE-dependent endpoints (IP phones, cameras, APs) negotiate the expected class. If you adopt the new 10G uplinks, build the link aggregation and spanning-tree relationships on the MS225 before cutover and diff them against the MS220 config so nothing silently drops.

4. Physical: rack, power, PoE, uplinks, optics, stacking

Both switches are 1RU. Confirm rack power and closet thermals, then plan optics deliberately: the MS225's 10G SFP+ uplinks need SFP+ transceivers and, ideally, fiber or Cat6A to the distribution layer, where the MS220 likely ran 1G SFP. If you are stacking, order the stacking cables and lay out the stack ring before the maintenance window. Verify your PoE budget covers the in-use ports at their negotiated class; the 370W ceiling is unchanged, so a closet that was already maxed on the MS220 will be maxed on the MS225 too.

5. Phased cutover

Stage the MS225 in the dashboard, push the validated config, and cut over one closet at a time during a window. Move uplinks first, confirm dashboard connectivity and stack health, then migrate access ports in batches, validating PoE and client reachability as you go. Keep an MS220 on hand as a temporary fallback until the new switch has run clean for a maintenance cycle.

6. Secure decommission

Remove retired MS220 units from the dashboard org, wipe local configuration, and dispose through a documented chain of custody. For federal, DoD, and healthcare environments, follow your media-sanitization standard and retain the disposal record; an unsupported switch left racked "just in case" reintroduces the exact audit exposure you just closed.

Procurement notes

Source MS225-48LP units through an authorized Cisco partner. For US federal, DoD, and SLED buyers, confirm TAA compliance and country-of-origin documentation up front, validate genuine Meraki serials with clean dashboard entitlement, and plan for current lead times rather than assuming stock. Government Purchase Card (GPC) orders, contract vehicles, and quote-to-PO timelines all benefit from engaging the partner early so licensing, TAA paperwork, and delivery line up with your fiscal year. Buying gray-market MS220 units to extend a dead platform only deepens the support and audit problem.