MikroTik vs Cisco: the cheap router, the expensive badge and the truth neither fan club likes

The scandal in one sentence

MikroTik sells an astonishing amount of router for the money; Cisco sells an operating model around the router. Both fan clubs quietly omit the bill they dislike: Cisco enthusiasts minimise licences and support costs, while MikroTik enthusiasts value their own engineering time at precisely zero.

That is why most “MikroTik versus Cisco” arguments are theatre. One person compares Ethernet ports and packet rates. Another compares global support, validated designs and procurement frameworks. They are measuring different products while shouting the same word: router.

This article makes the comparison useful. It examines MikroTik RouterOS and Cisco IOS XE where they overlap, treats Cisco Meraki separately, and gives you commands to audit devices you own or administer. It is not sponsored by either vendor. No polo shirt has influenced the verdict.

Was I hacked?

The badge on the router cannot answer that. Start with evidence.

Treat the device as a possible incident if you find an unknown administrator, an exposed management service, an unexplained configuration change, a new scheduled task or script, unfamiliar DNS or proxy settings, suspicious tunnels, logging disabled, or software affected by a known exploited vulnerability.

Do not reboot or factory-reset immediately if an investigation matters. First:

1. restrict Internet access to the management plane at an upstream firewall if you can do so safely;
2. record the time, model, serial number, software release and active administrators;
3. export the running configuration and collect logs without publishing credentials or keys;
4. compare users, services, routes, DNS, NAT, firewall rules, VPN peers and startup configuration with the approved baseline;
5. rotate device and automation credentials from a clean administrative system;
6. escalate according to your incident plan when unauthorised access or persistence is plausible.

A strange open port is a reason to investigate, not proof of compromise. A clean port scan is not proof of innocence either. An attacker who already has administrative access can use permitted protocols, change traffic, or remove an exposed service after establishing persistence.

For the MikroTik API session-expiration issue disclosed in 2026, use the CVE-2026-14227 investigation and remediation guide. For external validation, the public-IP Nmap lab explains how to scan only systems you own or are authorised to test.

Verdict before the fan clubs arrive

The short answer is not “MikroTik for small networks, Cisco for big ones”. A well-designed MikroTik network can be substantial. A small company can rationally buy Cisco because one hour of downtime costs more than the equipment. The right dividing line is usually operational risk, not office headcount.

First outrage: this is not an apples-to-apples comparison

MikroTik lists the RB5009UG+S+IN at a suggested price of US$219. The device includes seven 1-gigabit ports, one 2.5-gigabit port, a 10-gigabit SFP+ cage, an ARM64 processor, 1 GB of RAM and a RouterOS Level 5 licence. MikroTik says the preinstalled licence requires no separate purchase and provides software updates for the life of the product or at least five years from purchase.

Cisco's Catalyst 8300 Edge platforms occupy a different commercial and operational class. Cisco's own documentation describes mandatory term-based licences at initial purchase to unlock capabilities and offers the platform with Cisco DNA software subscriptions or enterprise licensing arrangements. Encrypted throughput above certain levels can also involve HSEC licensing and export restrictions.

Putting an RB5009 and a Catalyst 8300 into one price table and declaring a winner is rather like comparing a fast estate car with a fire engine because both have tyres. The inexpensive device may be exactly right. The expensive one may carry capabilities, support obligations and certifications that the cheaper device was never designed to replace.

The honest comparison starts with requirements:

• required routed and encrypted throughput with the actual security features enabled;
• number of routes, peers, VRFs, tunnels and policies;
• high-availability and failover behaviour;
• configuration review, automation and telemetry integrations;
• replacement time and vendor escalation;
• software support lifetime;
• available engineers and their real hourly cost;
• regulatory and procurement requirements.

Only then should a model and price enter the conversation.

The hardware-price scandal

MikroTik's advantage is obvious and real: modest hardware can expose BGP, OSPF, WireGuard, IPsec, VLANs, VRFs, queues, policy routing, a capable stateful firewall, APIs and scripting without turning every menu item into a new purchase order.

That is not charity. The trade-off is that the purchaser often assembles more of the operating system around the box:

• design review;
• tested templates;
• central configuration backup;
• alerting and log retention;
• spare units and replacement logistics;
• maintenance windows;
• escalation to a specialist when the routing table has developed opinions.

Cisco generally charges more because enterprise customers buy more than silicon. With an appropriate support contract, Cisco TAC provides round-the-clock technical support and replacement options. Cisco also maintains extensive product documentation, security advisories, design guides, certification programmes and a very large labour market.

None of that proves the Cisco device will be configured correctly. It means there is a mature support machine available when it is not.

The scandal is therefore not that Cisco costs more. The scandal is buying Cisco without using the operational benefits, or buying MikroTik without funding the engineering work that replaces them.

The licensing scandal — with one important correction

MikroTik RouterOS

On RouterBOARD hardware, RouterOS is normally preinstalled and licensed. The licence level controls capabilities, but the ordinary ownership experience does not resemble an annual feature subscription for every router. MikroTik publishes stable, long-term, testing and development release channels and provides an in-product update process.

That simplicity is valuable. It does not remove the obligation to test updates, check architecture compatibility, upgrade RouterBOOT where appropriate and retain a rollback path.

Cisco IOS XE and Catalyst 8000

Cisco's Catalyst 8300 documentation says term-based licences are mandatory at initial purchase to unlock capabilities. Cisco DNA subscriptions, network-stack entitlements, throughput levels, security features, support and cryptographic export controls can all affect the quote.

This does not mean every Cisco router stops forwarding the moment a calendar reminder is missed. Entitlement behaviour depends on the product, software release, licence model and feature. Procurement must obtain the exact bill of materials and written renewal behaviour for the chosen design.

Ask the reseller to state, in plain language:

1. what functions work on day one;
2. what expires and when;
3. what continues to forward traffic after expiry;
4. which software downloads and security fixes require an active contract;
5. which throughput or encryption limits apply;
6. what support and replacement response has actually been purchased.

If the answer is a 46-line spreadsheet containing twelve acronyms and no sentence, ask again.

Cisco Meraki is a separate comparison

Meraki belongs to Cisco, but its cloud-managed licensing must not be lazily attributed to every Cisco platform. Under Meraki's co-termination model, official documentation describes a 30-day grace period after licence expiry, followed by organisation shutdown: dashboard management is restricted and devices cease passing user traffic. Per-device licensing similarly provides a grace period before the unlicensed device or product shuts down.

That dependency may be acceptable because the cloud dashboard reduces local operational work. It may be unacceptable because a subscription mistake can become an outage. The decision is commercial architecture, not a moral failing.

Performance: where benchmark theatre begins

MikroTik deserves credit for publishing RouterBOARD performance tables. The RB5009 page includes results across frame sizes and configurations, and it explicitly warns that different configurations change performance.

The largest number in any router data sheet is usually the least useful number in a production design. Ask what was enabled:

Test the exact software train, configuration and traffic profile. Record latency, loss, CPU, memory, temperature and failover time, not merely gigabits. A router that forwards 9.8 Gbit/s in a laboratory and takes eleven minutes to restore your important tunnels is not a 10-gigabit success story.

Security: neither logo patches itself

Brand loyalty is particularly unhelpful here.

MikroTik RouterOS through 6.42 was affected by CVE-2018-14847, a WinBox directory-traversal vulnerability that allowed an unauthenticated remote attacker to read arbitrary files. Older or exposed MikroTik devices have consequently been attractive targets, especially when administrators left WinBox or other management services reachable from the Internet.

Cisco IOS XE suffered an equally sobering episode in 2023. Cisco's advisory for CVE-2023-20198 and CVE-2023-20273 described active exploitation of the Web UI: an attacker first created a privilege-15 local user, then used the second flaw to elevate to root and write an implant. Cisco scored the first issue 10.0. CISA added the chain to its Known Exploited Vulnerabilities catalogue and later referenced it in reporting on state-sponsored activity.

The useful conclusion is not “Vendor A has a CVE, therefore Vendor B wins”. CVE totals are poor league tables because product scope, installed base, research attention, component reuse and disclosure practice differ. One exposed, unpatched management interface is more important than a slide containing 200 decontextualised vulnerability IDs.

Your real controls are gloriously unbranded:

• keep management services off the public Internet;
• use a dedicated management network or strongly authenticated VPN;
• patch on a documented schedule with emergency handling for exploited flaws;
• remove unused services and accounts;
• restrict administrators by source, role and protocol;
• export configurations and detect unauthorised changes;
• send logs to a separate system;
• test recovery and keep appropriate spares;
• inventory the exact hardware, software, licences and owners.

Default-configuration mythology

“MikroTik is insecure by default” and “Cisco is secure by default” are both too crude to be useful.

Many MikroTik home and small-office products ship with a basic firewall, DHCP and sensible WAN/LAN assumptions. MikroTik's own first-time guide warns that removing the default configuration removes those protections. Some CCR devices and advanced deployments, however, are intended to be configured deliberately and may not give an inexperienced operator the safety net they imagined.

Cisco enterprise devices also require a deliberate security design. Enabling an HTTP management feature, permitting VTY access from broad networks, leaving legacy protocols active or failing to update IOS XE can undermine the logo very efficiently.

Never approve a router because it is “factory default”. Approve an observed configuration against a documented policy.

Practical audit: MikroTik RouterOS

Run the following through a trusted administrative path on a router you own or manage. These commands are observational; save their output to a protected case or change record because configurations and logs can reveal sensitive network details.

/system resource print
/system routerboard print
/system package print
/system package update check-for-updates
/ip service print detail
/user print detail
/user active print detail
/ip address print detail
/ipv6 address print detail
/ip firewall filter print stats
/ipv6 firewall filter print stats
/ip firewall nat print detail
/ip route print detail
/log print where topics~"account|critical|error|warning"

Answer these questions:

• Is the installed release still supported and on the intended channel?
• Does RouterBOOT need an upgrade after RouterOS?
• Are Telnet, FTP, HTTP WebFig or plain API enabled without a recorded requirement?
• Can SSH, WinBox, WebFig or API be reached from the WAN?
• Are there unknown users or currently active sessions?
• Does the IPv6 input policy protect the router as carefully as IPv4?
• Do NAT, DNS, proxy, SOCKS, UPnP, cloud and scheduled-script settings match the baseline?
• Are logs retained somewhere other than the device?

Restrict management services

The following is an example, not a universal paste block. Confirm that 10.10.10.0/24 is genuinely your management network, start Safe Mode or keep console access, and change one path at a time.

/ip service disable telnet
/ip service disable ftp
/ip service disable www
/ip service disable api
/ip service set ssh address=10.10.10.0/24
/ip service set winbox address=10.10.10.0/24

If HTTPS WebFig or API-SSL is required, configure a trusted certificate and restrict the source network. MikroTik's current service documentation says the service address property is best suited to trusted networks and recommends firewall rules for untrusted sources. Use both layers.

Do not forget MAC WinBox, MAC Telnet and neighbour discovery. MikroTik recommends disabling production MAC services when they are not required:

/tool mac-server set allowed-interface-list=none
/tool mac-server mac-winbox set allowed-interface-list=none
/tool mac-server ping set enabled=no
/ip neighbor discovery-settings set discover-interface-list=none

In a managed LAN you may instead limit these features to a deliberate management interface list. Disabling every recovery path remotely, with no console and no verified IP management, is not hardening. It is an unscheduled site visit.

Back up and update

First inspect storage and export the configuration:

/file print
/export file=pre-upgrade hide-sensitive
/system backup save name=pre-upgrade
/system package update check-for-updates

Copy the export and binary backup to protected storage. A RouterOS backup may contain sensitive material and is not a public attachment. Confirm power, maintenance window, architecture, package compatibility and a tested recovery path.

When the change is approved:

/system package update set channel=stable
/system package update install

The installation can download packages and reboot the router. After it returns, verify services and then inspect whether RouterBOOT requires an upgrade:

/system routerboard print
/system routerboard upgrade
/system reboot

MikroTik strongly recommends upgrading the bootloader after RouterOS where applicable. Do not treat the second reboot as an optional surprise for colleagues on a video call.

Practical audit: Cisco IOS XE

Use an authorised console, management VPN or dedicated management network. Exact commands and output vary by platform and release.

show clock
show version
show inventory
show install summary
show license summary
show ip interface brief
show ipv6 interface brief
show ip http server status
show running-config | section line vty
show running-config | include ^username|^aaa|^ip http|^ip ssh
show access-lists
show users
show logging

Check:

• the installed IOS XE release against Cisco's Software Checker and security advisories;
• whether HTTP or HTTPS management is enabled and why;
• which networks can reach VTY and Web UI services;
• whether AAA, local break-glass accounts and privilege levels match policy;
• whether configuration changes are centrally archived;
• whether licence and support expiry dates have owners and alerts;
• whether IPv6 management access is controlled separately;
• whether logging reaches a protected external collector.

Disable an unused Web UI

Cisco recommended disabling the HTTP Server feature on Internet-facing systems affected by the 2023 Web UI vulnerabilities. If your operational design does not require the Web UI:

configure terminal
 no ip http server
 no ip http secure-server
end
show ip http server status

Validate SSH and console access before saving. If the Web UI is genuinely required, use HTTPS only, keep the release fixed and restrict reachability with a management ACL and upstream firewall. Never publish it to the Internet for convenience.

Restrict VTY access to SSH from a management subnet

This example permits the documentation network 10.10.10.0/24. Replace it with your actual management range and test from a second session before closing the first.

configure terminal
 ip access-list standard MGMT_ONLY
  permit 10.10.10.0 0.0.0.255
  deny any log
 exit
 ip ssh version 2
 line vty 0 15
  transport input ssh
  access-class MGMT_ONLY in
 exit
end

Now open a second authorised SSH session through the intended path. Confirm AAA, privilege and command authorisation, then save according to your change procedure:

show users
show access-lists MGMT_ONLY
show running-config | section line vty
copy running-config startup-config

An IPv4 standard ACL does not magically govern IPv6. Design and test the IPv6 management policy on platforms where IPv6 is enabled.

The support scandal

Cisco's strongest argument is not a command. It is the ability, with the appropriate paid service, to open a severity-one case with TAC around the clock and obtain contracted replacement service. For an airline, hospital, factory or retailer, reducing the duration and uncertainty of an outage can be worth far more than the router.

MikroTik provides documentation, software updates, distributors, certified consultants, training and a large community. Many excellent engineers know RouterOS deeply. The organisation buying it must establish who will answer at 03:17, where the spare is stored and how quickly a failed or corrupted device can be rebuilt.

Community help can be superb. It is not the same thing as a contractual response commitment. Conversely, an unused Cisco support contract is merely a very formal receipt.

Calculate total cost without cheating

Use this model over the intended service life:

TCO = hardware
    + required licences and subscriptions
    + vendor or partner support
    + spare equipment and replacement logistics
    + power, racks and optics
    + design, deployment and migration labour
    + monitoring, backup and automation
    + training and documentation
    + planned maintenance labour
    + expected outage cost
    + retirement and replacement work

Create a worksheet with evidence rather than adjectives:

Do not assign zero pounds to internal labour merely because payroll already exists. Do not assign infinite value to a support brand without reading the response and replacement terms.

A fair proof-of-concept test

Shortlist exact models, then make both candidates perform the same job:

1. Load the proposed production configuration, not a blank benchmark.
2. Enable firewall, NAT, QoS, monitoring and the intended encrypted tunnels.
3. Test mixed packet sizes and realistic concurrent sessions.
4. Fail each WAN circuit and measure convergence and session impact.
5. Reboot, restore from backup and replace a device using the written runbook.
6. Apply a software update and exercise rollback or recovery.
7. Send a test log event and confirm it reaches monitoring with the correct identity and time.
8. Remove an administrator and prove that local, API and central credentials no longer work.
9. Open a realistic support request through the service you plan to buy.
10. Hand the system to the on-call engineer and see whether the documentation survives contact with another human.

The winner is the design that meets the requirement at the lowest acceptable whole-life risk. Sometimes that is MikroTik. Sometimes it is Cisco. Occasionally the test reveals that the requirement document was fan fiction.

Common bad arguments

“Cisco has more CVEs, therefore MikroTik is safer”

Not established. CVE counts require product scope, severity, exposure, exploitability, disclosure and patch latency. Compare the exact releases and enabled attack surface.

“MikroTik is cheap, therefore it is unreliable”

Price alone does not prove reliability. Measure environmental limits, power design, failure rates, software behaviour, spares and recovery time.

“Cisco costs ten times more, therefore it is ten times better”

There is no universal multiplier from invoice to outcome. The value may sit in a feature, integration, support response or compliance requirement. If you cannot name it, you may be buying reassurance by kilogram.

“We use Meraki, so nobody needs network skills”

Central management reduces some tasks. Somebody must still design addressing, segmentation, identity, failover, logging, licences and incident response.

“Our management port uses a non-standard number”

Bots can scan all 65,535 TCP ports while you are deciding what to have for lunch. Port changes reduce noise; access control reduces exposure.

“The router is behind NAT”

That does not protect IPv6, port forwards, VPN management paths, cloud controllers, compromised internal systems or accidental exposure. Test from every relevant trust zone.

Procurement questions that expose weak designs

Before approving either platform, require written answers:

• Which exact models, licences and software releases are proposed?
• What throughput remains with the intended encrypted and security features enabled?
• Which management services are enabled and from where can they be reached?
• Who receives security advisories and how quickly are critical exploited flaws patched?
• Where are configurations, logs and cryptographic recovery materials stored?
• What is the tested replacement and restore time?
• Which licence or support expiry can affect operation, updates or support?
• What happens when cloud management or the Internet is unavailable?
• Who answers an incident outside business hours?
• When does the hardware reach end of sale and end of support?
• Can the organisation recruit or contract another competent operator?
• Has the design been tested with IPv6, failover and realistic traffic?

If a supplier cannot answer these questions, the brand choice is not yet the largest problem.

Questions people ask after the meeting becomes emotional

Is MikroTik secure enough for a business?

It can be, when the exact device is supported, patched, deliberately configured, kept off untrusted management networks, monitored, backed up and operated by competent people. “Business” is not a security requirement; define uptime, threat, scale, support and compliance needs.

Is Cisco worth the money?

It can be when you need specific capabilities, integrations, support response, replacement service, lifecycle assurance or widely available skills. It is poor value when those benefits are neither required nor used.

Should a small office buy a spare MikroTik?

Often yes, if the hardware cost is low compared with downtime. The spare helps only when its software, configuration, credentials, optics, power supply and replacement procedure are ready and tested.

Does Cisco Meraki stop working without a licence?

Official Meraki documentation describes a grace period and subsequent shutdown or loss of user traffic under its licensing models. Verify the current rules for the exact Meraki product and licensing mode before purchase. Do not generalise this behaviour to every Cisco IOS XE product.

Which is easier to learn?

That depends on the operator. RouterOS exposes a great deal in WinBox and a consistent CLI hierarchy, while Cisco has an enormous training ecosystem and a syntax familiar to many network engineers. A graphical interface makes options visible; it does not make their consequences smaller.

Which one should I install at home?

For a curious operator, MikroTik is difficult to beat for learning and capability per euro. If the purpose is to practise for a Cisco environment, use legal virtual labs or appropriate Cisco equipment. The best lab is the one that teaches the platform you need without becoming the family's unplanned Internet outage.

The final verdict

Choose MikroTik when you value capability per euro, can supply the operational discipline, and have validated that the precise model meets the scale and resilience requirement.

Choose Cisco when the organisation benefits from the platform ecosystem, contractual support, replacement options, lifecycle processes and available expertise enough to justify the complete recurring cost.

Choose Meraki when central cloud operations are worth the subscription dependency, and record what happens at licence expiry before anybody enters a company card that itself expires first.

Do not choose any router because a forum has declared it “enterprise”. Enterprise networking is not a logo. It is inventory, least privilege, change control, monitored configuration, timely patching, tested recovery, supported hardware and a named person who notices when the box has quietly become somebody else's box.

That is the real scandal: the cheapest line in the network budget is often the router. The expensive part is pretending it administers itself.

Related reading

• MikroTik RouterOS API CVE-2026-14227: detection, containment and remediation
• Scan your public IP from outside with Nmap
• Linux server hardening for Ubuntu, Debian and Rocky Linux
• You ran the mystery script. Assume it won.

Safety boundary

Run audit and scanning commands only on devices and networks you own or have explicit permission to administer. Before changing management access, licences, firewall rules, bootloader or system software, confirm console or out-of-band access, export the current configuration, protect the backup, schedule the outage and test the rollback procedure. Vendor syntax and licensing change between models and releases; validate every command against the documentation for the exact platform.

References

• MikroTik RB5009UG+S+IN product page and published performance results
• MikroTik RouterOS upgrading and installation
• MikroTik RouterOS IP Services
• MikroTik: Securing your router
• MikroTik: First Time Configuration
• NIST NVD record for CVE-2018-14847
• Cisco Catalyst 8300 Series Edge Platforms FAQ
• Cisco Catalyst 8300 Series Edge Platforms data sheet
• Cisco Catalyst 8300 and 8200 Series Edge Platforms ordering guide
• Cisco advisory: Multiple Vulnerabilities in Cisco IOS XE Software Web UI Feature
• CISA Known Exploited Vulnerabilities Catalogue
• Cisco Technical Services Resource Guide
• Cisco Meraki co-termination licensing FAQ
• Cisco Meraki per-device licensing overview

Reviewed 5 September 2026. Prices, licence terms, support programmes, product availability and recommended software releases change. Verify the current terms and advisories for the exact model before procurement or maintenance.