Cisco Meraki MX85 Review: Branch Simplicity and the Limits That Matter

The reason to buy it is the operating model

For a central team responsible for many branches, the MX85’s value is the amount of network work that can stay centralized. Dashboard management and Auto VPN reduce the need to build and maintain each branch as a separate administrative project. That is a meaningful advantage when local staff can connect equipment but do not manage routing or security policy.

The operator accounts reviewed support that advantage. A network administrator describing a mixed MX68, MX85 and MX105 deployment reported easier VPN administration, better visibility and simpler expansion across sites, while also questioning cost. A separate IT director described easier remote-site deployment and a reduced engineering burden, but identified pricing and licensing as drawbacks. These are useful observations about operating the platform; neither account isolates an MX85 performance test. Both reviews are marked incentivized, so we give them limited weight and do not use them to estimate reliability or financial return.

Cartennas’s assessment is that the management benefit grows with the number of similar branches and the scarcity of network engineering time. It is less compelling for one uncomplicated office whose firewall rarely changes. Buying into the same platform everywhere can reduce operational variation, but a standardized appliance still needs enough capacity for the busiest location in its group.

Read the performance figure for the security mode you will use

Cisco’s current sizing guide uses MX 19.1x as its reference for this model. Its results distinguish traffic detection from active prevention. The headline firewall number alone therefore does not answer whether an inspected business connection will fit.

For Cartennas, the practical buying threshold is workload under the intended policy. A branch that needs sustained near-gigabit traffic with prevention enabled should evaluate a larger appliance. Changing the security policy to make a speed test look better does not resolve a sizing mismatch.

Why older reviews disagree about speed

An MX85-specific technical discussion from April 2023 recorded operators measuring about 500 Mbps and questioning documentation that had previously shown 750 Mbps. A Cisco employee replied that the expected figure in that discussion was around 500 Mbps and requested a documentation correction. This explains part of the product’s mixed performance reputation, but the old discussion does not establish results for every later firmware release.

The documentation still needs careful reading. Cisco’s product landing page lists a 500 Mbps site-to-site VPN figure, while the current model datasheet and firmware-specific sizing guide list 1 Gbps. We use the explicitly versioned sizing reference for the table above. An engineer evaluating an existing unit should record its firmware and enabled services before comparing a measurement with either number.

The useful conclusion is not that every slow test proves a defective MX85. It is that a purchasing decision built from an undated specification or a single forum result can be wrong in either direction. The exact security mode, traffic path and software release are part of the product being evaluated.

Four WAN interfaces have a specific operating limit

The MX85 offers two SFP and two copper WAN interfaces, plus eight copper and two SFP LAN interfaces. Its normal WAN arrangement supports two active uplinks. In that arrangement, the SFP and copper interfaces are paired; an installed SFP can determine which member of a pair is usable. A physically connected cable is therefore not enough to establish that its WAN interface is active.

The optional Backup Uplink mode, supported from MX 18.2, changes that mapping. On the MX85, physical ports 1 and 2 become the active WANs, port 4 becomes backup, and port 3 is disabled. Ports 1 and 2 require SFP modules, including copper SFPs where appropriate. Enabling the mode briefly reinitializes the WAN interfaces, so it belongs in a maintenance window.

The backup path also lacks IPv6 and several inbound NAT functions, including port forwarding. That matters if the branch hosts something that must be reachable from outside. Cartennas would evaluate continuity by the business services that survive on the backup connection, rather than counting the number of connected circuits. Cisco’s newer four-active-uplink feature applies to listed Secure Router platforms, not to the MX85.

Licensing changes the comparison with another firewall

A hardware-only comparison misses a substantial part of the MX85 decision. Under Cisco’s subscription model, MX85-HW falls within the MX Medium class, LIC-MX-M. The current subscription documentation uses Essential and Advantage tiers, and includes core security functions in both. Advantage adds capabilities such as particular application and WAN health features; some integrations require separate entitlements.

Existing Meraki organizations may use a different licensing arrangement, so older Enterprise or Advanced Security descriptions should not be applied automatically to a new subscription quote. The comparison needs the organization’s actual licensing model, required feature tier, term, support coverage and renewal responsibility.

The operator feedback about cost is relevant because the recurring expense buys an operating model, not just a feature list. Our assessment is to compare that expense with the engineering work the platform removes across the fleet. For a team already maintaining Meraki networks, adding another consistent branch may be attractive. For a team comfortable with another platform, migration and retraining can consume much of the expected administrative saving.

MX75, MX85 or MX95: choose for the constraint

A recurring theme in model-comparison discussions is whether the MX85 provides enough over the MX75 to justify the step up. Older forum recommendations sometimes treat the model number as a performance ranking. The current figures do not support that shortcut: both models share the same listed prevention throughput. The MX85’s stronger argument is its rack format, LAN fiber connectivity and greater session and VPN scale.

The MX95 becomes the more relevant comparison when protected throughput or faster interfaces are the limiting factor. Cartennas would not choose a smaller appliance solely because today’s Internet circuit is slow if a contracted upgrade or a growing VPN workload already changes the requirement.

What a technician should verify during evaluation

The dashboard’s throughput tool measures communication with the Meraki cloud; Cisco explicitly says it is not an accurate measurement of the Internet circuit’s capacity. Use traffic from a wired LAN client for a WAN test and record the security policy in effect. A slow dashboard test on an attached switch should not automatically trigger replacement of the firewall, cable or Internet service.

The MX85 has a dedicated management interface for local access. That is useful when a remote engineer loses the normal path during a cutover, but it helps only if the onsite technician can identify the interface and the team has approved local access ready. Firmware also affects local-page behavior: Cisco documents the move to TLS on this platform from MX 19.2. An old access instruction can therefore become a troubleshooting distraction.

For hardware resilience, Cisco supports a warm-spare pair using the same MX model and states that the pair needs one license. The cabling and upstream address design still determine what happens during failover. Cartennas would include a controlled loss-of-connectivity test and application recovery checks in acceptance, because seeing two appliances in Dashboard does not establish that the required business traffic survives a fault.