Connect. Secure. Manage.
Network Segmentation
Separate users, devices and applications across Cisco and Meraki networks using an agreed access model, enforceable controls and evidence-based testing.
Devices supported
across the UK
Client locations
supported
Traffic handled
at peak time
Average
response time
Average response is not a resolution time or a contractual guarantee. Support scope and response commitments are agreed for each engagement.
Network segmentation limits which users, devices and applications can communicate, reducing unnecessary paths through a business network. The useful outcome is not a larger number of VLANs; it is an access model that people can explain, enforce and maintain. MCI Network Services designs segmentation for Cisco and Meraki environments, connecting business requirements with routing, identity and firewall controls that can be tested against real application behaviour.
Defined trust
Make access boundaries explicit rather than relying on an assumed internal network.
Controlled access
Connect identity, policy and network enforcement to the services people actually use.
Evidence for change
Test the intended security outcome and retain useful operational records.
Start with the relationships that matter
We identify the systems being protected and the people or services that need access to them. Staff devices, guest users, management interfaces, building systems and production workloads may require different boundaries. The design should reflect genuine differences in trust and purpose rather than separating departments simply because they appear on an organisation chart.
Application dependencies are important from the outset. A server may need identity, DNS, backup, monitoring and licensing services in addition to its main client connection. We map those dependencies with the relevant owners so that security changes do not unexpectedly interrupt normal operation or lead to broad emergency exceptions later.
Standards & partnerships
Confidence in the team behind your network.
Cisco Partner
Cisco Meraki
Cyber Essentials
Cyber Essentials PlusMCI Network Services is operated by Proxar Ltd. Certifications apply to the certified legal entity and the scope of its certificates. View accreditation information
Choose enforcement that matches the estate
Cisco routing contexts, VLANs, access lists, firewalls and identity-based controls can contribute to segmentation, but they do different jobs. Meraki policies and supported group-based capabilities also need to be assessed in their actual platform and licence context. We select an arrangement that the available equipment can enforce and the customer's team can operate.
A logical label does not prove isolation. Two VLANs may still communicate freely through a gateway, and two workloads on the same virtual switch may exchange traffic without reaching the physical firewall. We locate the real forwarding paths and identify where each intended restriction will be applied. Any path that bypasses enforcement is recorded explicitly.
A useful starting point
Not sure where to start?
Bring the requirement. We will help you define the engineering work.
Define permitted flows before blocking everything else
A flow matrix translates the business requirement into source, destination, service and purpose. It includes owners and review dates for important exceptions. This gives engineers a defensible basis for configuration and gives application teams a clear way to request changes without asking for unrestricted access between entire networks.
We also decide what should happen when identity or policy services are unavailable. Emergency operation, guest access and critical infrastructure may need different responses. Those decisions are agreed with the customer; a convenient fallback that joins previously separated networks is not silently accepted as resilience.
Different environments. The same care.
Built around the work
your network supports.
Finance, banking and the wider private sector. We start with the systems and people that depend on your connections.
Finance & banking
Market-data paths, routing and provider coordination on clients’ behalf.
Financial-market services ↗Offices & multi-site teams
Reliable access between people, workplaces and business applications.
Office network design ↗Data centres & cloud
Network boundaries, workload connections and operational ownership.
Data centre networks ↗Separate broad boundaries from detailed controls
Large trust zones often provide a useful first step. Internet-facing services, user access, management and production systems can have clear boundaries even before more detailed workload controls are introduced. Our network macrosegmentation work concentrates on those larger divisions and their routed or firewalled connections.
More granular controls may be justified inside a zone where the application or risk requires them. We assess the operational cost of detailed policies, how identities or groups are assigned, and how changes will be monitored. A complex policy that cannot be maintained can become less dependable than a simpler boundary with clear ownership.
Migrate in an order that protects business operation
Segmentation changes often expose dependencies that have never been documented. We therefore begin with observation and a limited pilot, compare intended rules with actual traffic, and agree a route back before expanding enforcement. Monitoring can inform the design, but the absence of a flow during a short observation period does not prove it is never needed.
Cutover planning includes maintenance windows, management access and the teams required to validate applications. Temporary rules receive an owner and removal condition. We avoid leaving a broad transition permit in place merely because the first test passed; closing those exceptions is part of completing the project.
Prove both access and isolation
Acceptance testing checks allowed business workflows and representative connections that should be denied. The scope covers relevant wired, wireless, remote-access and cloud paths, including alternative gateways where applicable. A successful user login is useful, but it does not demonstrate that a guest device cannot reach a management interface.
The resulting evidence identifies the source and destination tested, the enforcement point and the observed result. Where segmentation supports a regulatory or assurance programme, we coordinate with its owner or assessor. Network configuration contributes evidence; it does not by itself certify the organisation or settle every compliance requirement.
Keep the boundaries useful after handover
The handover includes diagrams, the access matrix, configuration ownership and a process for reviewing exceptions. Monitoring should make unexpected cross-boundary traffic visible and distinguish a policy refusal from a failed service. Periodic review is particularly valuable after acquisitions, cloud migrations or changes to shared infrastructure.
MCI delivers Cisco and Meraki network services throughout the UK, with a strong engineering presence in Kent and work across London and the surrounding counties. Share the systems you need to separate and the operational constraints you face. We can assess the existing paths and develop an achievable segmentation plan rather than adding controls without a clear purpose.
Technical references
- Network segmentation overview — Cisco / Cisco Meraki
- Zero-trust network and cloud design — Cisco / Cisco Meraki
Talk to a specialist
What does your network need next?
Tell us what you are planning, changing or trying to improve. We will help define a practical next step and the engineering scope.
+44 203 196 6566Choose option 1
sales@proxar.co.ukUK-wide service.
Most of our engineers are based in Kent, with a focus on London, Sussex, Essex and Berkshire.
Existing customers should use their agreed support and escalation channels. This form is for service enquiries, not a monitored emergency ticket.
Tell us what you need.
A short outline is enough. Please do not include passwords or sensitive network details.
Thank you. Your enquiry has been submitted.
Please check your name, email and message, then try again.
Your form session expired. Please try again.
Please wait a minute before sending another enquiry.
We could not submit your enquiry. Please call or email us instead.