Connect. Secure. Manage.
Cisco Secure Access Branch Integration
Connect Cisco and Meraki branch networks to Cisco Secure Access, checking tunnel support, routing, resilience and location-based policy.
Devices supported
across the UK
Client locations
supported
Traffic handled
at peak time
Average
response time
Average response is not a resolution time or a contractual guarantee. Support scope and response commitments are agreed for each engagement.
Cisco Secure Access branch integration connects an office network to cloud-delivered security without leaving routing and user access to chance. The project needs to account for the branch router, available internet services, identity information and the applications people actually use. MCI Network Services helps organisations integrate supported Cisco and Meraki branch environments with Cisco Secure Access, defining where traffic is inspected and how the site operates when a connection fails.
Defined trust
Make access boundaries explicit rather than relying on an assumed internal network.
Controlled access
Connect identity, policy and network enforcement to the services people actually use.
Evidence for change
Test the intended security outcome and retain useful operational records.
Decide which branch traffic belongs in the service
A branch does not necessarily need to send every packet through the same security path. Public websites, software-as-a-service applications, private systems, voice services and local printers have different dependencies. We establish the intended treatment for each traffic class before building tunnels or changing the default route. This prevents a security rollout from unintentionally sending local business traffic through a distant service.
The assessment includes existing VPNs, direct internet access, cloud connections and any centrally hosted applications. We ask who owns each route and where inspection currently happens. A new cloud service should replace or complement a documented function, not introduce a second policy layer that nobody understands when an application stops working.
Standards & partnerships
Confidence in the team behind your network.
Cisco Partner
Cisco Meraki
Cyber Essentials
Cyber Essentials PlusMCI Network Services is operated by Proxar Ltd. Certifications apply to the certified legal entity and the scope of its certificates. View accreditation information
Verify the branch platform and connection method
We check the exact appliance or router model, software, subscription and supported integration method. Cisco Catalyst SD-WAN and Meraki MX deployments should not be assumed to have identical tunnel, routing or policy capabilities. The configuration must follow the supported combination rather than a general diagram showing an office connected to a cloud.
Addressing, tunnel endpoints, routing exchange and permitted source networks are recorded in the implementation specification. Where BGP is part of the selected integration, we define the expected advertisements and route filters. Where another supported method is used, the same questions about route ownership and withdrawal still apply. Licences and cloud-service configuration are confirmed before a production cutover is booked.
A useful starting point
Not sure where to start?
Bring the requirement. We will help you define the engineering work.
Design resilience beyond the tunnel status
A tunnel can appear established while the application path is unusable. We review the health signals available at the branch and the behaviour expected when a tunnel, internet circuit or security-service connection fails. The design should distinguish losing redundancy from losing all access and explain how either condition reaches the support team.
We also decide whether traffic should be blocked, redirected or allowed through an alternative approved path during an outage. This is a business security decision, not merely a convenient technical default. An uninspected fallback may be unacceptable for some users, while blocking every connection can prevent engineers reaching the equipment needed for recovery. Those trade-offs belong in the agreed scope.
Different environments. The same care.
Built around the work
your network supports.
Finance, banking and the wider private sector. We start with the systems and people that depend on your connections.
Finance & banking
Market-data paths, routing and provider coordination on clients’ behalf.
Financial-market services ↗Offices & multi-site teams
Reliable access between people, workplaces and business applications.
Office network design ↗Data centres & cloud
Network boundaries, workload connections and operational ownership.
Data centre networks ↗Connect identity and location to policy carefully
A branch location can provide useful policy context, but a shared source address does not identify every individual behind it. We examine which identity signals the chosen integration actually supplies and how they relate to user groups, devices and network locations. Policies should not depend on information that the enforcement point cannot reliably obtain.
Shared devices, visitors and service accounts need explicit treatment. We test what happens when a user cannot be identified or belongs to several groups, and who approves any exception. Administrators also need a clear distinction between access to the security console and the policies governing ordinary branch traffic.
Pilot with real applications and both internet paths
The first deployment should represent the branch types that will follow. We test DNS, browsing, authentication, downloads and the important business applications, including those using embedded content or unusual connection patterns. Where TLS inspection is included, certificate distribution and approved exclusions form a separate, visible part of the test plan.
Failure and restoration tests check more than whether another tunnel comes up. We observe application recovery, public source-address changes, routing advertisements and logging. A restored preferred circuit should not repeatedly move traffic between paths. Any instability is investigated before the configuration becomes the template for dozens of other sites.
Roll out without hiding local differences
A repeatable configuration is valuable, but branches can differ in addressing, bandwidth, local services and provider equipment. We record those variables and validate them before each deployment. A site survey may identify constraints that were invisible in a central inventory, such as an unmanaged upstream router or an internet service without the expected addressing arrangements.
The handover includes branch diagrams, approved traffic paths, configuration ownership, recovery access and escalation contacts. Our Cisco Secure Access services can cover the wider platform alongside the branch work, while ongoing monitoring and response responsibilities are agreed separately. Share your site list, current WAN design and critical application paths so we can define an integration that fits the estate rather than forcing every office into the same assumptions.
Technical references
- Secure Access and Meraki BGP integration — Cisco / Cisco Meraki
- Cisco Secure Access technical support documentation — Cisco / Cisco Meraki
Talk to a specialist
What does your network need next?
Tell us what you are planning, changing or trying to improve. We will help define a practical next step and the engineering scope.
+44 203 196 6566Choose option 1
sales@proxar.co.ukUK-wide service.
Most of our engineers are based in Kent, with a focus on London, Sussex, Essex and Berkshire.
Existing customers should use their agreed support and escalation channels. This form is for service enquiries, not a monitored emergency ticket.
Tell us what you need.
A short outline is enough. Please do not include passwords or sensitive network details.
Thank you. Your enquiry has been submitted.
Please check your name, email and message, then try again.
Your form session expired. Please try again.
Please wait a minute before sending another enquiry.
We could not submit your enquiry. Please call or email us instead.