In short: The Cisco Umbrella Meraki integration works in three ways: a DNS integration that applies Umbrella policy per Meraki wireless SSID or group policy; a standard IKEv2 IPsec tunnel from a Meraki MX to Umbrella SIG; and the Meraki Umbrella SD-WAN Connector, which closed to new customers on 20 May 2025.
Three ways to connect Meraki to Umbrella
| Option | What it does | Umbrella package | Status |
|---|---|---|---|
| DNS integration (Meraki wireless) | Links the Meraki dashboard and Umbrella so DNS from clients on a Meraki access point SSID or group policy is redirected to Umbrella and checked against that network device's policy | Any package (DNS-layer) | Available |
| MX IPsec tunnel to SIG | A standard IPsec tunnel from any Meraki MX to Umbrella SIG for web and firewall inspection | SIG Essentials or above | Available |
| Meraki Umbrella SD-WAN Connector | Auto VPN connection from branch MXs to Umbrella-hosted connector hubs | SIG Essentials or above | Closed to new customers from 20 May 2025; existing users unaffected |
All three work alongside normal DNS forwarding to the Umbrella DNS servers, which any Meraki network can use with no integration at all.
DNS integration through the Meraki dashboard
Cisco's Umbrella documentation describes an integration between the Meraki dashboard and Umbrella DNS for clients on Meraki access points. You assign an Umbrella filtering policy to a specific SSID or group policy in Meraki; from then on, every DNS request from clients under it is redirected to Umbrella and checked against the policy set for that network device in the Umbrella dashboard. Cisco notes that the integration needs a minimum Meraki access point firmware release.
That lets you treat, say, a staff SSID, a guest SSID and a pupil group policy differently without extra hardware, and reports show which of them a request came from rather than just a public IP address. It is a lighter-touch option than a tunnel and suits organisations on the DNS packages. What each Meraki product supports changes over time, so we confirm the current options for your hardware and licence before designing around them.
Any Meraki network can also simply forward DNS to Umbrella, and Cisco documents configuring a Meraki network to proxy DNS to Umbrella. Internal DNS and named users still need Umbrella virtual appliances and the AD Connector, or a cloud directory integration.
Meraki MX IPsec tunnel to Umbrella SIG
For full SIG protection, a Meraki MX can build a standard IPsec tunnel to Umbrella. Meraki's own documentation says customers who do not need SD-WAN or Auto VPN connectivity to Umbrella SIG can connect "with a standard IPSec tunnel from any MX appliance". The tunnel needs SIG Essentials or SIG Advantage, and Umbrella accepts IKEv2 only.
In outline:
- Create a network tunnel identity in the Umbrella dashboard (Deployments, Core Identities, Network Tunnels) and note its tunnel ID and passphrase.
- In the Meraki dashboard, open the site-to-site VPN settings, set the MX as a hub and enable VPN for the VLANs whose traffic should go to Umbrella.
- Under organisation-wide settings, add a non-Meraki VPN peer: IKEv2, Cisco's predefined Umbrella IPsec policy, the public IP of the Umbrella data centre, the tunnel ID as the local ID, the passphrase as the pre-shared secret, and 0.0.0.0/0 as the private subnet so all internet-bound traffic uses the tunnel.
- Keep traffic to the Umbrella DNS resolvers outside the tunnel, as Meraki recommends, so DNS-layer policy keeps working.
- Add a second peer, with its own tunnel credentials, to another Umbrella data centre for resilience.
- Apply web and firewall policy to the tunnel identity in Umbrella and test.
The full tunnel design, including redundancy and what to send, is on Umbrella IPsec tunnels. For the MX itself, see Meraki MX firewalls.
The Meraki Umbrella SD-WAN Connector
The Meraki Umbrella SD-WAN Connector placed Meraki connector hubs in Umbrella's cloud. Branch MXs joined them as Auto VPN spokes, and all internet-bound traffic went to Umbrella SIG. Each deployment used a pair of data centres, with a regional disaster recovery data centre behind them, and needed SIG Essentials.
Meraki has announced that the connector was discontinued for all new customers from 20 May 2025. Meraki says existing customers actively using it are not affected. If you are planning a new deployment, do not design around it.
For new SD-WAN-to-SSE designs, Meraki's security service edge integration documentation includes Cisco Secure Access configuration and design guides for Meraki SD-WAN, including a BGP configuration guide. Talk to us about which fits; see also Meraki SD-WAN.
Which option suits you
- DNS packages and a Meraki estate: use DNS forwarding, plus the Meraki wireless DNS integration if you want different policy per SSID or group policy.
- SIG customers with a few Meraki sites: MX IPsec tunnels to two Umbrella data centres.
- Existing SD-WAN Connector users: keep it running, and plan its replacement as part of your Secure Access migration.
- Large Meraki SD-WAN estates starting fresh: compare Cisco Secure Access with Meraki SD-WAN integration against an Umbrella tunnel design, bearing in mind Umbrella's end of sale on 31 January 2027.
Umbrella's last date of support is 31 January 2029; see Cisco Umbrella end of life and Umbrella to Secure Access migration.
How we help
Forever Group supplies and supports Cisco Meraki as well as Umbrella, so we can design both ends. We link Meraki and Umbrella dashboards, build MX tunnels with resilience, set DNS and web policy, and plan the move to Secure Access for Meraki SD-WAN estates. Contact us to review your design, or read the full Cisco Umbrella deployment guide.
How Forever Systems supplies and supports Cisco Umbrella
We supply, deploy and support Cisco Umbrella for UK organisations, and plan the move to its successor, Cisco Secure Access.
- Package selection: DNS Security or SIG, Essentials or Advantage, plus add-ons, matched to your users, sites and compliance needs
- Deployment: network DNS forwarding, virtual appliances, the roaming module in Cisco Secure Client, Chromebooks, IPsec tunnels from Cisco Meraki and other firewalls, and Active Directory, Entra ID or SAML identity integration
- Policy design: security categories, content filtering for schools and businesses, allow and block lists, and reporting
- Migration planning from Umbrella to Cisco Secure Access ahead of Cisco's end-of-sale and end-of-support dates
- Ongoing support: reporting, policy tuning, renewals and licence changes
Forever Systems Ltd is an independent IT and cyber security provider and also supplies the wider Cisco Secure portfolio.
Want a Cisco Umbrella quote, deployment or migration plan?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Does Cisco Meraki integrate with Umbrella?
Yes. Meraki can apply Umbrella DNS policy per wireless SSID or group policy through a dashboard integration, build a standard IPsec tunnel from an MX to Umbrella SIG, or, for existing customers only, use the Meraki Umbrella SD-WAN Connector.
Can I apply different Umbrella policies to different Meraki SSIDs?
Yes. With the Meraki and Umbrella DNS integration you assign an Umbrella policy to an SSID or group policy, and DNS from clients under it is checked against that policy in Umbrella.
Is the Meraki Umbrella SD-WAN Connector still available?
Not to new customers. Meraki discontinued it for all new customers from 20 May 2025. Existing customers actively using it are not affected.
What Umbrella package do I need for a Meraki MX tunnel?
SIG Essentials or SIG Advantage. Network tunnels are not part of the DNS packages.
Should DNS go through the Meraki tunnel to Umbrella?
Meraki recommends keeping traffic to the Umbrella DNS resolvers outside the tunnel so DNS-layer policies continue to work.