GuideTechnology Architecture

Network Licensing Decoded: Cisco vs Competitors on Licences, Prices and Support

Hardware ≠ licence ≠ cloud management ≠ support ≠ security subscription. How Cisco, HPE, Juniper, Arista, Fortinet, Palo Alto and others really charge — with real reseller prices from October 2026.

Rupesh Kumar

9 Oct 2026 · 15 min read

The hardware price on a quote is rarely the number that matters. Over five years, subscriptions, cloud management, support and security services usually outweigh the box itself. This part breaks down how each vendor charges, with real reseller prices captured on 8 October 2026.

Key takeaways

Treat hardware, software licence, cloud management, support and security subscription as five separate line items — bundles hide the split.

Cisco Catalyst 9000 orders require a 3-, 5- or 7-year term subscription on top of the perpetual licence; renewals are the largest Cisco campus OPEX lever.

Meraki, Aruba Central (AOS-10 APs) and Mist APs need an active cloud licence to keep working — budget them as mandatory OPEX.

How to read prices in this series. Confirmed / Public MSRP = published by the vendor or a named reseller's list price. Reseller price = advertised by a named authorised reseller on 8 October 2026. Market estimate = my street-price range for budgeting. Enterprise quote = not publicly disclosed; large deals typically land 30–60% below list. Planning rates: USD 1 = INR 95 = EUR 0.87.

The rule for every evaluation

Rule for every evaluation: Hardware cost ≠ Software licence ≠ Cloud management ≠ Support ≠ Security subscription. Each is a separate line item, has a separate term, and is renewed (or not) independently. Many vendors bundle them on a single SKU for convenience, which hides the split.

Licensing models at a glance

Model	Cisco	HPE Aruba	Juniper	Arista	Huawei	Fortinet	Extreme	Palo Alto	Ubiquiti / MikroTik
Perpetual OS licence	Yes (Network Ess./Adv.)	Yes (AOS-CX base)	Yes (Junos base)	Yes (EOS)	Yes (base + some feature)	Yes (FortiOS)	Yes (legacy) / Platform ONE	Yes (PAN-OS base)	Yes, no subs
Term subscription	Mandatory (Catalyst/DNA 3/5/7 yr)	Central Foundation/Advanced	Mist subs; Flex tiers	CloudVision, AGNI	Optional (NCE, SD-WAN)	FortiGuard bundles	Platform ONE tiers	Mandatory for security value	No
Device-based	Yes	Yes	Yes	Yes	Yes	Yes	Yes (pooled)	Yes	N/A
Port-based	Some (port tiers)	By port count tier	By model tier	Tiered	Some	No	Tiered by device class	No	No
User-based	SASE/Duo/ISE endpoint	SSE per user, ClearPass per endpoint	Secure Edge per user	AGNI per user	Limited	FortiSASE per user	ZTNA per user	Prisma Access per user	No
Bandwidth-based	SD-WAN tiers by throughput	EdgeConnect by bandwidth	SSR by bandwidth	VeloCloud by bandwidth	SD-WAN	No (appliance)	SD-WAN	Prisma SD-WAN / remote network	No
Cloud mgmt licence	Meraki (mandatory)	Central (mandatory for cloud)	Mist (mandatory for APs)	CVaaS	NCE cloud	FortiCloud/ FortiLAN	ExtremeCloud IQ	Strata Cloud Manager	Free
Security subscription	Secure Firewall Threat/Malware/URL	Gateway IDS/IPS	SRX ATP	Partner	USG bundles	UTP/Enterprise bundles	Partner	Core Security bundle	Basic IPS (Ubiquiti)
Support contract	Smart Net Total Care / Solution Support	Foundation Care	Juniper Care	A-Care	Huawei Co-Care	FortiCare Premium/Elite	ExtremeWorks	Standard/Premium	Warranty only (+ optional UI Care)

Cisco licensing in detail

Element	How it works	Procurement implication
Network Stack (Network Essentials / Network Advantage)	Perpetual licence tied to Catalyst 9000 hardware; Essentials covers L2/basic L3, Advantage adds full routing, VRF, MPLS/EVPN, etc.	Choose tier up front; upgrading later costs more than buying Advantage at purchase for distribution/core.
Cisco Catalyst / DNA subscription (Essentials / Advantage)	Per Cisco ordering guides, new Catalyst 9000 orders require a matching-tier term subscription of 3, 5 or 7 years alongside the perpetual stack licence.	This is the 'hidden' recurring cost. Renewal pricing is the largest Cisco campus OPEX lever.
Catalyst Center (formerly DNA Center)	Renamed in 2024. Meters per managed device; tiers Essentials, Advantage, Premier.	Appliance/VM capex plus device subscriptions; size for growth.
Meraki licensing	Every Meraki device needs an active licence for dashboard management and support (co-term or per-device). MX licence tiers: Enterprise and Advanced Security (adds IDS/IPS, AMP, content filtering).	If the licence lapses, devices stop passing traffic after the grace period — treat as mandatory OPEX.
Cisco Networking Subscription (unified)	Newer offer (CISCO-NETWORK-SUB) letting Meraki and Catalyst devices use unified Essentials/Advantage licences (e.g., Wi-Fi 7 APs, smart switching), managed in cloud or on-prem.	Simplifies hybrid estates; evaluate vs. legacy SKUs and ELA.
Security subscriptions	Secure Firewall threat/malware/URL, Umbrella/Secure Access per user, Duo per user, ISE Essentials/Advantage/Premier per endpoint.	ISE and SSE are separate budgets from LAN; often 20–35% of total Cisco spend.
Smart Licensing / Smart Licensing Using Policy	Licences live in Smart Accounts/Virtual Accounts; SLUP makes many tiers unenforced but reportable.	Compliance is audited at renewal/true-up; keep Smart Account hygiene.
Support (Smart Net Total Care / Solution Support)	8x5xNBD to 24x7x4 hardware replacement + TAC + software updates.	Typically priced as an annual % of list; renew in sync (co-term).
Enterprise Agreement (EA)	Multi-year commitment across networking, security, Splunk etc.	Better unit pricing but 'true-forward' penalises shrinking device counts.

Competitor licensing equivalents

Vendor	Licensing model	What is mandatory vs. optional	Watch-outs
HPE Aruba Networking	Perpetual AOS-CX/AOS-10 + Central subscription (Foundation / Advanced) per device, 1/3/5/7/10 yrs; ClearPass perpetual or subscription per endpoint; EdgeConnect by bandwidth tier; SSE per user.	AOS-10 APs require Central; switches can run without cloud.	Central Advanced is meaningfully dearer than Foundation; check gateway licences.
Juniper (HPE)	Junos perpetual base + Flex Standard/Advanced/Premium (term) for features; Mist Wi-Fi/Wired Assurance per device; Marvis add-on; Apstra per device; SRX security subs.	Mist Wi-Fi Assurance is mandatory for Mist APs; Marvis needs Wired Assurance.	Roadmap convergence with Aruba Central may change SKUs — insist on price protection.
Arista	EOS perpetual with feature licences (e.g., routing scale); CloudVision as-a-Service per device; AGNI per user; VeloCloud per edge/bandwidth.	CloudVision optional but expected.	Fewer bundles; optics pricing matters.
Huawei	Perpetual hardware + feature licences; iMaster NCE per device; optional SnS (Software Subscription & Support).	Mostly perpetual.	SnS needed for upgrades; regulatory constraints outweigh price.
Fortinet	Perpetual FortiOS; FortiGuard bundles (ATP, UTP, Enterprise) 1/3/5 yrs; FortiSwitch/FortiAP mostly licence-free when managed by FortiGate; FortiSASE per user.	Bundles are optional but needed for security value.	Bundled SKUs (e.g., FG-60F-BDL-950-36) are cheaper than à la carte.
Extreme Networks	Extreme Platform ONE Networking: Standard, Advanced, Premium; Standard required for ExtremeCloud IQ management; licences pooled and portable across devices; legacy perpetual feature licences still supported on non-Universal switches.	Standard tier needed for cloud management.	Pooled licences reduce stranded cost.
Palo Alto Networks	Appliance + per-device subscriptions (Advanced Threat Prevention, Advanced URL, Advanced WildFire, DNS, SD-WAN) — bundled as Core Security; Prisma Access per user/site.	Without subscriptions the device is a basic stateful firewall.	Over 5 years subscriptions can be 3–4× the appliance; negotiate renewal caps.
Check Point	Appliance + Quantum security packages (NGFW/NGTP/SandBlast); Harmony SASE per user.	Packages required for threat prevention.	Management server licence separate.
Versa	Subscription per site/bandwidth (Secure SD-WAN, SASE tiers); often delivered via service providers.	Subscription mandatory.	Pricing often bundled in managed service.
VMware by Broadcom	Subscription only; per physical core (16-core minimum per CPU). NSX networking ships inside VMware Cloud Foundation; advanced security (vDefend) is an additional per-core attach.	Must buy VCF to get NSX.	Major cost increases for many customers since 2024.
Ubiquiti / MikroTik	No recurring licences; RouterOS licence level bundled with hardware (MikroTik).	None.	No enterprise TAC; optional Ubiquiti UI Care (e.g., US$259 per Pro Max 48 PoE for 5 yrs).
Cato / Zscaler	Pure SaaS per user/site/bandwidth.	Subscription mandatory.	Cloud dependency; data-residency (PoP) checks.

Hardware pricing: representative SKUs

Representative, comparable SKUs. List/MSRP and reseller prices are from public listings on the dates shown; all other figures are estimates for budgeting.

Vendor / model	Configuration	Throughput / capacity	Price (USD)	Price type	Source (date)
Cisco C9300-48P-E	48×1G PoE+ (437W default PSU), modular uplinks, Network Essentials	StackWise-480, 256 Gbps switching	$2,765 (was $2,925)	Reseller price (hardware only; DNA/Catalyst sub extra)	IT Bargain Center listing, viewed 8 Oct 2026
Cisco C9300-48P-E	Same, UK	—	£5,065 ex VAT (special) / £5,331 regular	Reseller price (UK)	Sync (wearesync.co.uk), viewed 8 Oct 2026
Cisco C9300-48P-E incl. DNA 3Y	Same + 3-yr DNA subscription	—	€4,350 incl. VAT	Reseller price (DE marketplace)	eBay.de Comstex, updated Aug 2025
Cisco Meraki MX67	Branch SD-WAN security appliance	~450 Mbps stateful FW	Not publicly disclosed – partner quote; est. $600–$900	Market estimate	—
Fortinet FortiGate 60F + 3 yr UTP bundle	10×GE, SPU; 3-yr 24×7 FortiCare + FortiGuard UTP (FG-60F-BDL-950-36)	700 Mbps threat protection	$1,847–$1,939 (MSRP $2,389–$2,508)	Reseller price + MSRP	SHI, viewed 8 Oct 2026
Palo Alto PA-440	8×GE desktop NGFW	3.0 Gbps FW / 2.2 Gbps threat	€2,490 ex VAT (≈ $2,860)	Reseller price (FR, appliance only)	Optinoc product page, viewed 8 Oct 2026
Ubiquiti USW-Pro-Max-48-PoE	16×2.5G + 32×1G, 720W PoE++, 4×10G SFP+	L3, Etherlighting	$1,299 base; $1,401 incl. tariff surcharge	Vendor store price (Confirmed)	store.ui.com (US), viewed 8 Oct 2026
Ubiquiti USW-Pro-Max-48-PoE	Same, via reseller	—	$1,516–$1,552	Reseller price	SHI, viewed 8 Oct 2026
HPE Aruba CX 6300M 48-port PoE	48×1G Class 4 PoE, 4×50G SFP56	~880 Gbps	Not publicly disclosed; est. $4,000–$6,500 street	Market estimate	—
Juniper EX4100-48P	48×1G PoE+, 4×25G	~496 Gbps	Not publicly disclosed; est. $3,500–$6,000 street	Market estimate	—
Arista CCS-720XP-48ZC2	48×mGig PoE, 6×100G	~1.6 Tbps	Not publicly disclosed; est. $4,000–$7,000 street	Market estimate	—
Huawei S5735-L48P4X	48×1G PoE+, 4×10G	~176 Gbps	Not publicly disclosed; est. $1,200–$2,500 street	Market estimate	—
Extreme 5420M-48W-4YE	48×1G PoE+, 4×25G	~400 Gbps	Not publicly disclosed; est. $2,500–$4,500 street	Market estimate	—
Wi-Fi 7 enterprise AP (Cisco CW9176I / Aruba 735 / Mist AP47 / Arista C-460)	4×4 tri-band, 10GbE	—	Not publicly disclosed; est. $900–$1,600 street	Market estimate	—
400G DC spine (Arista 7060X5/X6, Cisco N9K-9364D, Juniper QFX5240)	32–64×400G/800G	12.8–51.2 Tbps	Enterprise quote; est. $35,000–$90,000 street	Market estimate	—

Costs that are commonly missed

Item	Typical cost position	Notes
Optics (SFP/SFP+/SFP28/QSFP28/QSFP-DD)	Vendor-branded optics 3–10× third-party; 10G SR $20–$150 (3P vs. branded), 100G $150–$1,500, 400G $600–$4,000	Arista/Juniper/Dell tolerate compatible optics more readily; Cisco/HPE may restrict TAC support.
DAC/AOC cables	$13–$40 (10G DAC, Ubiquiti list) up to $300+ for 400G	Use DAC inside racks to save optics cost.
Redundant PSUs, fans, stacking cables	+8–20% per access switch	Catalyst 9300 ships with one PSU by default.
Controllers / management appliances	$15k–$120k (Catalyst Center, ClearPass, FortiManager, NCE)	Cloud mgmt converts this to OPEX.
Spares pool	3–5% of hardware capex	Critical for India/remote sites where RMA can be 2–5 days.
Rack accessories, PDUs, UPS	1–3% of capex	—
Logistics & import duties	India: BCD 10–20% + SWS + 18% IGST (input credit available to GST-registered buyers); EU: 0% duty on most IT (ITA) + VAT 17–27%	Duty classification disputes common in India (see Part 5).

Software and subscription pricing

Licence / subscription	Term	Price (USD)	Price type	Annualised	Source (date)
Meraki MX67W Advanced Security + Enterprise support (LIC-MX67W-SEC-1YR)	1 yr	$523.99 (list $735.57)	Reseller price	$524	CDW, viewed 8 Oct 2026
Meraki MX67 Advanced Security (LIC-MX67-SEC-1YR)	1 yr	$359.94 (list $686.39)	Reseller price	$360	Hummingbird Networks, viewed 8 Oct 2026
HPE Aruba Central Advanced, 1 switch (JZ535AAE)	1 yr	$665 (MSRP $825)	Reseller + MSRP	$665	SHI, viewed 8 Oct 2026
HPE Aruba Central Advanced, 1 switch 8–12 ports (JZ526AAE)	3 yr	$766 (MSRP $950)	Reseller + MSRP	$255	SHI, viewed 8 Oct 2026
HPE Networking Central Advanced, 1 switch (6400/5400 class, S0T70AAE)	5 yr	$4,977 (list $7,425)	Reseller price	$995	CDW, viewed 8 Oct 2026
HPE Aruba Central Advanced, 1 WLAN gateway (S0V01AAE)	1 yr	$2,986 (MSRP $3,706)	Reseller + MSRP	$2,986	SHI, viewed 8 Oct 2026
Juniper Mist Wired Assurance + Care Core, EX 48-port (SUB-EX48-1S-5Y-COR)	5 yr	$1,085 (list $1,363)	Reseller price	$217	CDW, viewed 8 Oct 2026
Juniper Mist Wired Assurance + Same Day support, EX 48-port	5 yr	$10,447 (list $12,074)	Reseller price	$2,089	CDW, viewed 8 Oct 2026
Juniper Mist Wi-Fi Assurance (per AP)	per month	~$10–$20 per AP/month	Market estimate (aggregator)	$120–$240	Costbench, Jun 2026
Fortinet FortiGate 60F UTP bundle (HW + 3 yr)	3 yr	$1,847–$1,939	Reseller price	≈ $500 sub/yr (est.)	SHI, viewed 8 Oct 2026
Palo Alto PA-440 'Bundle Complete' (threat, URL, WildFire, GlobalProtect, SD-WAN)	1 yr	€2,890 ex VAT (≈ $3,320)	Reseller price (FR)	≈ $3,320	Optinoc, viewed 8 Oct 2026
Palo Alto PA-440 3-yr TCO with bundle	3 yr	€11,160 ex VAT (≈ $12,830)	Reseller-computed	—	Optinoc, viewed 8 Oct 2026
VMware Cloud Foundation (includes NSX)	per core / yr	~$350 per core/yr list; 16-core minimum per CPU	Market estimate (licensing advisory)	—	Redress Compliance, 2026
VMware vDefend (NSX distributed firewall) attach	per core / yr	~$120–$200 per core/yr on top of VCF	Market estimate	—	Redress Compliance, 2026
Cisco Catalyst/DNA Advantage (per 48-port switch)	5 yr	Not publicly disclosed – partner quote; est. $1,500–$3,500 street	Market estimate	$300–$700	—
Cisco ISE / Aruba ClearPass / FortiNAC per endpoint	per yr	Enterprise quote; est. $2–$15 per endpoint/yr	Market estimate	—	—
SASE / SSE per user (Prisma Access, FortiSASE, Cisco Secure Access, Zscaler, Cato, HPE SSE)	per yr	Enterprise quote; est. $60–$180 per user/yr depending on features and volume	Market estimate	—	—

Support and maintenance

Vendor	Standard	Premium / 24x7	Software updates	Hardware replacement	Typical annual cost (% of HW list, est.)	TAC quality notes
Cisco	SNTC 8x5xNBD	24x7x4, Solution Support, Success Tracks	Requires active contract	NBD / 4-hr depots globally	10–20%	Deepest global TAC; large knowledge base.
HPE Aruba	Foundation Care NBD	24x7 / 4-hr, Aruba TAC	Included with Central / FC	NBD / 4-hr; limited lifetime warranty on many CX/Instant On	8–15%	Good; lifetime warranty reduces HW cost.
Juniper (HPE)	Juniper Care Core	Same Day / 24x7x4	With Care / subs	NBD / same-day	8–15%	Strong SP-grade JTAC; Mist bundles support into subs.
Arista	A-Care NBD	4-hr onsite	With A-Care	NBD / 4-hr	10–15%	Very well regarded; engineer-to-engineer.
Huawei	Co-Care basic	24x7 premium	SnS	NBD / 4-hr (country dependent)	5–10%	Strong in Asia/MEA; constrained in restricted markets.
Fortinet	FortiCare Premium (24x7)	FortiCare Elite (15-min SLA)	Included in bundles	NBD advance replacement	Included in bundle (~15–25% of HW/yr incl. FortiGuard)	Mixed reviews at scale; improving.
Extreme	ExtremeWorks NBD	24x7, ResidentEngineer	Included	NBD / 4-hr	8–14%	Frequently praised for in-house TAC.
Palo Alto	Standard	Premium (24x7), Focused Services	Requires support	NBD / 4-hr	15–20% (+ security subs)	Strong security TAC.
Ubiquiti	Warranty (1–2 yr)	UI Care (5-yr advance replacement, e.g., $259/unit for Pro Max 48 PoE)	Free	Advance replacement with UI Care	~4%	Community-driven; no enterprise TAC.
MikroTik	Warranty	Via distributors/consultants	Free	Distributor RMA	~0–3%	No vendor TAC.

AMC (Annual Maintenance Contract) in India is often delivered by the system integrator on top of OEM support at 6–12% of hardware value per year, covering on-site engineers, spares and preventive maintenance; budget both OEM back-to-back support and SI AMC.

Practical advice

Buy the right Cisco tier up front. Upgrading from Network Essentials to Advantage later costs more than buying Advantage for distribution/core at purchase.
Model renewals, not just year one. Palo Alto subscriptions can reach 3–4× the appliance cost over five years; negotiate renewal caps.
Watch optics. Vendor-branded optics run 3–10× third-party; ask for a fixed optics price list or third-party optics support.

Next: how these line items add up over five years in Part 4 — TCO across four scenarios.

Research date: 8 October 2026. Vendor-neutral and independent — no vendor sponsorship. Prices, licences and product names change frequently; re-validate every figure with at least two authorised partners per region before purchasing. TCO figures are illustrative models built on stated assumptions, not quotations. Gartner content is cited via vendor and press announcements. Not legal, tax or investment advice.