In short
A Meraki teleworker gateway (Z-series) is a compact cloud-managed firewall, router and Wi-Fi 6 access point that sits on a home worker's broadband and builds an Auto VPN tunnel back to an MX at head office. It broadcasts corporate SSIDs, powers a desk phone, applies central firewall and traffic policies, and is managed in the Meraki dashboard.
Get a quote for Meraki teleworker connectivity
Tell us roughly how many users or sites you have and we will reply by email with options and a quote.
What the teleworker gateway does
Most home workers connect with a software VPN on their laptop. That works for the laptop, but not for a desk phone, a printer, a second device or anything that cannot run a VPN client. A teleworker gateway takes a different approach: it extends the corporate network itself to the home.
The Z-series gateway plugs into the home router or broadband line. It then:
- Builds an Auto VPN tunnel to an MX security appliance at your office or data centre, configured from the dashboard with no manual VPN settings.
- Broadcasts your corporate SSID at home (and, if you wish, a separate personal or guest SSID), so company devices connect as they would in the office.
- Provides wired ports, including a power over Ethernet port for an IP desk phone or similar device.
- Applies your policies centrally: stateful layer 3 and layer 7 firewall rules, VLANs and traffic shaping, so you decide what goes back to the office and what goes straight to the internet.
- Supports 802.1X on wired and wireless ports, so only authorised devices get on the corporate network.
Because it is managed in the Meraki dashboard, a central IT team can ship gateways to staff, have them come online without a site visit, and see each home office's status and traffic alongside the rest of the network.
The current Z-series hardware
Meraki's current teleworker gateway is described by its datasheet as an enterprise-class firewall, VPN gateway and router with:
- Dual-band Wi-Fi 6 wireless.
- One gigabit Ethernet WAN port and four gigabit Ethernet LAN ports, one of them PoE+ for a VoIP phone or other powered device.
- Desktop or wall mounting.
- Client VPN endpoint, Auto VPN and IPsec VPN endpoint, layer 3 and layer 7 stateful firewall, NAT, VLANs and DHCP, static routing, custom traffic shaping, IPv6, NetFlow, syslog and remote packet capture.
- Automatic firmware upgrades from the dashboard.
A cellular version adds a built-in LTE modem with external antennas, used as a backup uplink when the home broadband fails or as the connection for a remote location. Meraki's datasheet positions the gateway for a small number of devices (its recommended use case is up to 15) and lists a lifetime hardware warranty on the gateway itself, with one year on accessories.
Earlier Z-series models have reached end of sale, and the oldest has reached end of support. If you still run them, our Meraki end of life guide explains what end of support means and how to plan replacements.
Teleworker gateway licences: Z-Enterprise vs Secure Teleworker
Like every Meraki device, the teleworker gateway needs a licence. On co-term licensing there are two licence types for the current gateway (they do not apply to earlier Z models):
| Feature | Z-Enterprise | Secure Teleworker |
|---|---|---|
| Dashboard management, zero-touch provisioning and firmware | Yes | Yes |
| Site-to-site VPN (Auto VPN) and client VPN | Yes | Yes |
| Automatic WAN failover, cellular failover | Yes | Yes |
| Stateful firewall, VLAN routing, traffic shaping | Yes | Yes |
| Splash pages, group policies, configuration templates | Yes | Yes |
| Local breakout (IP based) and source-based routing | Yes | Yes |
| Content filtering, YouTube restriction, web search filtering | - | Yes |
| Geography-based firewall rules | - | Yes |
| Cisco Advanced Malware Protection (AMP) | - | Yes |
| Umbrella DNS integration (separate licence) | - | Yes |
| Malware analysis integration (separate licence) | - | Yes |
| WAN Health and VoIP Health analytics, smart breakout | - | Yes |
Source: Meraki's MX and Z licensing documentation. Note that Meraki's Secure Teleworker list does not include IDS/IPS, which is an MX feature. Meraki also says Z-series licences can be added to an organisation whatever its MX licence edition, but Z-Enterprise and Secure Teleworker licences cannot be mixed in the same organisation. On subscription licensing the teleworker gateway has its own product class and tiers; we can confirm which applies to your organisation.
Not sure which licence fits? Ask us
Tell us what you need and we will recommend the right licence for your organisation, with a quote.
Teleworker gateway vs client VPN vs ZTNA
A teleworker gateway is one of three common ways to connect home workers. They solve different problems:
| Teleworker gateway | Client VPN | Zero trust network access (ZTNA) | |
|---|---|---|---|
| What connects | The whole home office: laptops, phones, printers | One device running a VPN client | One user to specific applications |
| Hardware at home | A Z-series gateway | None | None |
| Desk phones and devices without a VPN client | Yes | No | No |
| Access model | Network extended to the home | Device joins the network | Per-application, identity-based |
| Managed from | Meraki dashboard | VPN headend and client software | Cloud security service |
| Best for | Permanent home offices, executives, call handling at home | Occasional remote access | Hybrid workers who mainly use cloud and web apps |
Many organisations use more than one: a gateway for staff who work from home every day and need a desk phone or several devices, and ZTNA or a VPN client for everyone else. Read more about zero trust network access (ZTNA) on our cloud security site, or Cisco Secure Client for Cisco's VPN client.
Security for the home office
A home office is a mixed network: the corporate gateway sits beside family devices, smart TVs and a consumer router. The teleworker gateway keeps those apart by putting company devices on their own wireless and wired network behind its own firewall, with only the traffic you choose sent back to the office.
A few design choices make a real difference:
- Authenticate devices, not just the network. 802.1X on the corporate SSID and wired ports, checked against your RADIUS or identity service, stops a personal device joining the corporate network with a shared password.
- Decide where internet traffic is inspected. If home internet traffic breaks out locally, Secure Teleworker's content filtering and malware protection, or a DNS or cloud security service, protect it. If everything returns over the tunnel, the head-office MX inspects it instead.
- Keep firmware current. Firmware is scheduled from the dashboard, so home gateways do not depend on users applying updates.
- Plan for leavers and lost devices. Keep the dashboard inventory current and remove gateways that leave the business from their networks, so the estate you manage matches the hardware staff hold.
For a wider view of securing hybrid workers, see secure access service edge (SASE) on our cloud security site.
Is Meraki teleworker connectivity the right fit for you?
We will check it against your systems and requirements and recommend the right option.
What you need before deploying teleworker gateways
- An MX to connect to. The gateway's Auto VPN tunnel terminates on an MX security appliance (physical or virtual) acting as a hub in your Meraki organisation.
- A design for home traffic. Decide which subnets and traffic go back to the office over the tunnel and which break out locally, and whether a personal SSID is offered.
- Authentication. Choose how devices join the corporate SSID and wired ports: pre-shared key, identity PSK or 802.1X against your RADIUS or identity service.
- Templates. For more than a handful of home workers, a configuration template keeps every gateway consistent and makes changes in one place.
- Shipping and claiming. Claim the gateways into the right networks before they ship, so staff only need to plug them in.
- Support process. Agree who staff contact when the home broadband, rather than the gateway, is the problem.
How Forever Systems helps
Forever Systems is a Cisco Partner. For home and small-site connectivity we can design the hub and tunnel configuration, choose the right licence type, build the templates, and supply and pre-stage the gateways so staff only need to plug them in. Where an MX hub is needed, see our Meraki MX service page, and for many sites at once our guide to multi-site networks.
Ask us for a quote for hardware and licences. Contact us to talk about connecting your home workers.
Working with us on Cisco Meraki
Forever Systems helps organisations plan, buy and run cloud-managed networks built on Cisco Meraki wireless, switching, security and SD-WAN.
- Plan the network: we look at your sites, users and existing kit, and can arrange a wireless site survey before anything is ordered
- Choose the right products: access points, switches, security appliances, cellular gateways, sensors and cameras sized to what each site needs, rather than a one-size bundle
- Licensing made clear: we explain co-termination, per-device and subscription licensing, check renewal dates and quote the licences you need
- Deployment help: we can set up the Meraki dashboard, organisations, networks, templates and policies, and help move you from older or on-premise kit
- Ongoing help: changes, licence renewals and reviews as your sites grow, with the scope agreed at quote
Ask us for a quote and we will confirm what is included for your organisation.
Frequently asked questions
What is a Meraki teleworker gateway?
A Meraki teleworker gateway (Z-series) is a compact cloud-managed firewall, VPN gateway, router and Wi-Fi access point for a home office. It connects back to an MX at head office over Auto VPN and extends corporate SSIDs, wired ports and policies to the home.
Does a Meraki Z-series gateway need an MX?
For its main purpose, yes. The Auto VPN tunnel that brings the home office onto the corporate network terminates on an MX security appliance, physical or virtual, in your Meraki organisation.
What is the difference between Z-Enterprise and Secure Teleworker licences?
Z-Enterprise covers the core features: Auto VPN, client VPN, stateful firewall, traffic shaping, failover and dashboard management. Secure Teleworker adds content filtering, geo-IP rules, malware protection, YouTube and search restrictions, WAN and VoIP health analytics and smart breakout, with Umbrella and malware analysis integrations needing separate licences.
Can a Meraki teleworker gateway use 4G?
Yes, the cellular version of the current gateway has a built-in LTE modem that can act as a backup uplink if the home broadband fails, or as the main connection where there is no fixed line.
Can I plug a desk phone into the teleworker gateway?
Yes. The current gateway has four gigabit LAN ports, one of which provides PoE+ power, so an IP desk phone can be powered and connected to the corporate voice network over the tunnel.
Still have a question about Meraki teleworker connectivity?
Ask us and a member of our team will reply by email.