Connect. Secure. Manage.
Cisco Firewall High Availability
Configure and test supported Cisco firewall resilience, accounting for state, interface failures, routing changes and application behaviour.
Devices supported
across the UK
Client locations
supported
Traffic handled
at peak time
Average
response time
Average response is not a resolution time or a contractual guarantee. Support scope and response commitments are agreed for each engagement.
Cisco firewall high availability should preserve an agreed set of network services when a device or connection fails. It does not guarantee that every application session survives every outage. MCI Network Services designs and tests supported Cisco firewall resilience, examining device state, physical paths, routing and management dependencies together so that the customer knows exactly which failures the design is intended to withstand.
Defined trust
Make access boundaries explicit rather than relying on an assumed internal network.
Controlled access
Connect identity, policy and network enforcement to the services people actually use.
Evidence for change
Test the intended security outcome and retain useful operational records.
Define the failure cases that matter
We begin with the services crossing the firewall and the customer's tolerance for interruption. Losing one appliance, one interface, a power feed or an upstream circuit can produce different outcomes. The design states which cases must be handled automatically and which require a documented manual response.
Application behaviour is part of that discussion. A web session may recover differently from a long-lived trading connection or a partner tunnel. We identify representative transactions and agree how recovery will be assessed. The availability requirement should describe usable service, not merely the time until an alternate device reports an active role.
Standards & partnerships
Confidence in the team behind your network.
Cisco Partner
Cisco Meraki
Cyber Essentials
Cyber Essentials PlusMCI Network Services is operated by Proxar Ltd. Certifications apply to the certified legal entity and the scope of its certificates. View accreditation information
Select a supported resilience arrangement
We verify the Cisco platform, software, licences and permitted high-availability topology. Requirements for device compatibility, interface mapping, state communication and management are checked against the actual release. A design supported on one family should not be copied to another without confirming its prerequisites.
The chosen arrangement must also fit the operating model. Maintenance, upgrades and replacement procedures can differ from ordinary single-device management. We explain those implications before implementation, including which changes affect the pair and which can be performed independently. Redundancy that nobody knows how to maintain can become a source of avoidable outages.
A useful starting point
Not sure where to start?
Bring the requirement. We will help you define the engineering work.
Make physical diversity meaningful
Two firewalls in one rack may still depend on the same power feed, switch or carrier handoff. We review cabling, upstream and downstream connections, rack power and the failure domains around the pair. A shared dependency is recorded rather than hidden by a diagram showing two appliances.
The state and failover communication paths are considered separately from production forwarding. Their capacity, protection and supported topology need to match the design. We assess what happens when communication between peers is interrupted and how the system avoids an inappropriate active state. Those conditions are tested where safe, not dismissed as unlikely.
Different environments. The same care.
Built around the work
your network supports.
Finance, banking and the wider private sector. We start with the systems and people that depend on your connections.
Finance & banking
Market-data paths, routing and provider coordination on clients’ behalf.
Financial-market services ↗Offices & multi-site teams
Reliable access between people, workplaces and business applications.
Office network design ↗Data centres & cloud
Network boundaries, workload connections and operational ownership.
Data centre networks ↗Align routing, NAT and session handling
The surviving device needs a valid path to both sides of the service. We examine routing adjacencies, virtual or physical addressing, neighbour updates and upstream acceptance of the changed path. A successful role transition cannot repair a routing design that continues sending traffic to the failed side.
Stateful features require particular care. We verify what connection and translation state is supported for synchronisation and identify limitations for the selected traffic and software. We do not promise universal session preservation. The acceptance plan observes representative connections so that the customer can distinguish a brief forwarding change from an application reconnect or a longer recovery process.
Monitor loss of resilience, not just total outage
A pair can continue carrying traffic after losing its standby capacity. That is an important incident even when users have not noticed a problem. We define monitoring for peer health, synchronisation, critical links and conditions that leave the service operating without its intended protection.
Alerts need an owner and a response. The operations team should know which checks are safe, which actions could force a transition and when vendor escalation is required. Repeated manual failovers without understanding a state or link problem can make an unstable service worse. We include evidence collection and decision points in the runbook.
Test failure and restoration
The test plan covers the agreed fault cases in a maintenance window proportionate to the risk. We capture normal state, introduce a controlled failure and compare routing, policy and application results. Restoration is observed as well, including whether the preferred role returns automatically and whether that causes another interruption.
Results state the exact conditions exercised and any manual steps required. A successful cable removal is not presented as proof of all hardware, software or site-failure scenarios. Where production testing is unsafe, the design records the supporting evidence and the remaining uncertainty so that the customer can make an informed acceptance decision.
Handover for reliable operation
MCI supplies the topology, compatibility record, monitoring requirements, replacement procedure and tested recovery behaviour. High availability can be delivered within Cisco Secure Firewall deployment or reviewed independently for an existing pair. The scope keeps firewall resilience separate from carrier commitments and application recovery, while showing how those responsibilities combine to maintain the customer's service.
Technical references
- Threat Defense high availability — Cisco / Cisco Meraki
Talk to a specialist
What does your network need next?
Tell us what you are planning, changing or trying to improve. We will help define a practical next step and the engineering scope.
+44 203 196 6566Choose option 1
sales@proxar.co.ukUK-wide service.
Most of our engineers are based in Kent, with a focus on London, Sussex, Essex and Berkshire.
Existing customers should use their agreed support and escalation channels. This form is for service enquiries, not a monitored emergency ticket.
Tell us what you need.
A short outline is enough. Please do not include passwords or sensitive network details.
Thank you. Your enquiry has been submitted.
Please check your name, email and message, then try again.
Your form session expired. Please try again.
Please wait a minute before sending another enquiry.
We could not submit your enquiry. Please call or email us instead.