Cisco Meraki MX600 EoL: Migrating to the MX450

If you are still running a Cisco Meraki MX600, the clock has already run out. The MX600 reached its Last Date of Support (LDoS) on May 20, 2025, the final milestone in a lifecycle that began winding down with End-of-Sale on May 20, 2018. That makes this not a planning exercise for some future budget cycle but a remediation item that is already overdue. This guide explains exactly what those dates mean, why Cisco maps the MX600 to the MX450, what you genuinely gain by moving, and how to execute the migration with minimal risk to a datacenter or large-campus security edge.

What the MX600 was, and why it is being retired

The MX600 sat at the top of the Meraki MX line as the modular, datacenter-class cloud-managed security and SD-WAN appliance. It was the unit you reached for when a branch-grade MX could not carry the load: a large campus headend, a hub site terminating hundreds of Auto VPN tunnels, or a datacenter perimeter. Its distinguishing trait was a modular interface design with expansion slots that let you populate copper or fiber port cards to match the deployment, plus redundant power for an appliance that was never supposed to go dark. It was a capable box for its era, rated in the multi-gigabit range for stateful firewall throughput.

That era is over. Meraki operates a cloud-first model where the dashboard, firmware, and security feeds are delivered as a service, and a platform that has passed LDoS no longer receives any of it. The MX600 is not slow because the silicon failed; it is retired because the support and software pipeline behind it has been switched off. Everything below follows from that single fact. You can review the canonical lifecycle record on our MX600 end-of-life page.

What each milestone date actually means

Cisco and Meraki use a consistent set of lifecycle milestones, and conflating them is how organizations end up surprised. Read them in this order.

• End-of-Sale (May 20, 2018): the last day the MX600 could be ordered new through Cisco. Everything in your rack today was sold before this date. Sale ending does not by itself stop the appliance from working, but it starts the countdown on everything that follows.
• End of Software Maintenance: not separately published for the MX600. In practice, dashboard-delivered firmware and security updates continue under the support window until the final cutoff, which for this platform is the Last Date of Support.
• Last Date of Support / LDoS (May 20, 2025): the hard wall. After this date there is no Cisco TAC, no hardware RMA, no warranty replacement, and critically no new firmware or PSIRT security fixes for the platform. A vulnerability disclosed against the MX600 codebase after this date does not get patched.

Why the MX450 is the right successor

Meraki maps the MX600 to two possible successors depending on scale. The MX450 is the direct datacenter and large-campus replacement; the MX250 is the smaller-tier option for hub sites that never grew into the MX600's full capacity. For anything that warranted an MX600 in the first place, the MX450 is the like-for-like or better choice, and it is the recommendation here.

The MX450 is a 1U fixed appliance, which is the most visible departure from the MX600's modular chassis. Instead of populating expansion cards, you get a fixed, high-density interface complement: gigabit copper ports plus 10 Gigabit SFP+ cages, including 10G SFP+ WAN uplinks, so you terminate fiber and copper directly with the right optics rather than ordering a port module. It keeps dual replaceable power supplies for the redundancy a headend demands. On throughput it meets or exceeds the MX600 envelope, with stateful firewall performance in the 6 Gbps class and advanced security throughput (IDS/IPS, content filtering, AMP) in the multi-gigabit range, and it scales to roughly 10,000 concurrent clients per appliance.

What you concretely gain

• Current security engine: the MX450 receives ongoing firmware, Snort-based IDS/IPS signature updates, Cisco Talos threat intelligence, AMP file reputation, and PSIRT fixes. The MX600 receives none of these after LDoS.
• Modern SD-WAN: Meraki Auto VPN and SD-WAN have advanced substantially since 2018, including better path selection, performance-based failover, and integration with Cisco Secure Connect / SASE for cloud-delivered security off the WAN edge.
• Simpler hardware lifecycle: fixed 10G SFP+ uplinks remove the expansion-card SKU sprawl of the MX600 and make sparing and standardization easier across a fleet.
• Higher session and tunnel scale headroom on current silicon, so a hub terminating large Auto VPN meshes has room to grow.

On licensing, the model itself is unchanged in shape but worth restating because it drives cost. Meraki MX is subscription-based per appliance, and you choose a tier: Enterprise (firewall, SD-WAN, Auto VPN, traffic shaping) or Advanced Security / Secure SD-WAN Plus (everything in Enterprise plus IDS/IPS, content filtering, geo-IP firewalling, AMP, and cloud security integration). The MX450 license is sized to the appliance, so an MX600 Enterprise or Advanced Security license does not transfer; you procure the MX450-tier subscription as part of the refresh. Co-terming the new license to your existing dashboard organization renewal date keeps billing clean.

A practical migration plan

Because Meraki centralizes configuration in the dashboard, an MX-to-MX migration is far less manual than a config-by-config firewall swap. Most of the policy, VLAN, firewall rule, and SD-WAN intent already lives in the cloud. The work is in physical readiness, license transition, and a clean cutover.

1. Assess and inventory

Pull the MX600 from the dashboard: record WAN interface assignments, VLANs and subnets, firewall and traffic-shaping rules, Auto VPN topology (hub vs spoke role, which spokes connect to it), and any third-party site-to-site VPN peers. Note the physical port mapping on the MX600's expansion cards so you know which uplinks land where. Capture current throughput and concurrent-client peaks so you confirm the MX450 sizing fits with headroom.

2. License and dashboard transition

Order the MX450 hardware and the matching license tier. Claim the new appliance into the same dashboard organization and, where possible, the same network, so it inherits the existing configuration template rather than being rebuilt from scratch. Align the license term to your org renewal so you are not managing split expiry dates.

3. Confirm feature parity

Verify that every MX600 feature in use is present and licensed on the MX450 tier you chose. Advanced Security features (IDS/IPS, content filtering, AMP) require the Advanced Security or Secure SD-WAN Plus tier, not Enterprise. Validate Auto VPN hub role, any BGP or OSPF route exchange, and third-party VPN settings before cutover, not during it.

4. Physical readiness

The MX450 is 1U with dual PSUs. Confirm rack units, redundant power feeds, and that you have the correct SFP+ optics for your WAN and LAN uplinks (the MX450 uses SFP+ cages rather than the MX600's interface cards, so the optics and breakout you need may differ from what is in the rack today). Stage cabling so the cutover is a move-and-seat operation, not a scavenger hunt for transceivers at 2 a.m.

5. Phased cutover

For a hub or datacenter MX, schedule a maintenance window and cut over the WAN uplinks and LAN trunks from the MX600 to the staged MX450. Because the configuration is dashboard-driven, the appliance comes up with policy already applied. Validate Auto VPN tunnel re-establishment to all spokes, default-route and internet egress, IDS/IPS and content filtering enforcement, and any inbound NAT or site-to-site peers. Keep the MX600 cabled but unplugged from production as an immediate rollback for the first window.

6. Secure decommission

Once stable, remove the MX600 from the dashboard organization to stop license waste, then wipe and dispose of the hardware under your data-handling policy. For federal and DoD environments, follow NIST SP 800-88 media sanitization for any device that held configuration, keys, or logs, and retain the certificate of destruction or sanitization for audit.

Procurement notes for regulated buyers

Two things tend to drive the timeline more than the technical work. First, lead times: datacenter-class appliances and the matching optics are not always on the shelf, and a multi-year subscription has to be quoted and approved, so start procurement before you schedule the cutover. Second, compliance of supply: federal and SLED buyers should confirm Trade Agreements Act (TAA) compliance and, where applicable, the appropriate approved-products path for the platform. As an authorized Cisco partner, uniqcli sources TAA-compliant hardware, accepts the Government Purchase Card (GPC), and quotes the MX450 with the right license tier and optics so nothing is missing at install. You can browse current MX and related security gear in our catalog, and see other retiring platforms on the Cisco end-of-life hub.