Connect. Secure. Manage.
Cisco TrustSec Design
Design Cisco TrustSec around security groups, policy ownership and enforcement capabilities, with staged integration into the existing network.
Devices supported
across the UK
Client locations
supported
Traffic handled
at peak time
Average
response time
Average response is not a resolution time or a contractual guarantee. Support scope and response commitments are agreed for each engagement.
Cisco TrustSec design uses security groups and supported enforcement capabilities to express access policy in terms that can be more stable than individual IP addresses. It can help organisations apply consistent restrictions as users and devices move, but it requires a clear model for classification, propagation and enforcement. MCI Network Services designs TrustSec deployments around those responsibilities, rather than assuming a security group tag automatically protects every path in the network.
Defined trust
Make access boundaries explicit rather than relying on an assumed internal network.
Controlled access
Connect identity, policy and network enforcement to the services people actually use.
Evidence for change
Test the intended security outcome and retain useful operational records.
Build a security-group model people can maintain
The first decision is what each group represents. Employees, contractors, operational devices and sensitive workloads may need different treatment, but creating a group for every minor exception can make policy difficult to understand. We work with the customer to define useful groups, naming conventions and the owner authorised to change membership or access.
The group model is connected to business flows. A policy matrix states which source groups may reach which destination groups and for what purpose. We identify shared services and management requirements early, because they often create the exceptions that determine whether an otherwise attractive design is practical.
Standards & partnerships
Confidence in the team behind your network.
Cisco Partner
Cisco Meraki
Cyber Essentials
Cyber Essentials PlusMCI Network Services is operated by Proxar Ltd. Certifications apply to the certified legal entity and the scope of its certificates. View accreditation information
Establish how endpoints are classified
TrustSec depends on assigning the appropriate context to traffic. We assess the supported classification methods in the actual estate, including identity-based assignment and defined mappings where appropriate. Cisco ISE may provide policy and identity functions, but its presence alone does not establish that every endpoint will receive a reliable classification.
Unmanaged equipment and shared systems need particular attention. We document what evidence supports their assignment and what happens when an endpoint cannot be classified. An unknown device should not inherit privileged access simply because a fallback was convenient during a pilot. The agreed treatment must balance security and the availability requirements of the affected service.
A useful starting point
Not sure where to start?
Bring the requirement. We will help you define the engineering work.
Verify propagation across the complete path
Security-group information has to reach the enforcement point through a supported method. Platform families, interface types, software releases and intervening devices can influence what is possible. We map the path and identify where tags or equivalent mappings are maintained, transformed or no longer available.
This review includes WAN connections, firewalls and any equipment outside the main Cisco environment. We do not assume an interoperability path carries the same context as a validated campus link. Where propagation is not supported, the design needs an explicit alternative or a clearly stated boundary, not a diagram suggesting seamless protection where none has been verified.
Different environments. The same care.
Built around the work
your network supports.
Finance, banking and the wider private sector. We start with the systems and people that depend on your connections.
Finance & banking
Market-data paths, routing and provider coordination on clients’ behalf.
Financial-market services ↗Offices & multi-site teams
Reliable access between people, workplaces and business applications.
Office network design ↗Data centres & cloud
Network boundaries, workload connections and operational ownership.
Data centre networks ↗Put enforcement in the right places
Security group access control lists and related supported controls enforce policy at particular points in the network. We verify hardware and software capability, resource limits and the traffic directions involved. The intended source-to-destination rule must be evaluated where the relevant context is actually known.
The design also considers traffic that remains local to a switch, host or virtual environment. A control on an upstream device cannot inspect a path that never reaches it. We record which flows TrustSec will govern and which require another mechanism, such as workload or firewall policy, to avoid overstating the scope of the solution.
Coordinate TrustSec with existing segmentation
Many customers already have VLANs, VRFs and firewall rules serving legitimate purposes. TrustSec does not automatically replace those boundaries. We examine how group-based decisions interact with routing and existing security policy, including which control is expected to permit or deny a connection first.
The transition plan identifies duplicated restrictions and conflicting ownership. An application team should not need to guess which of three policy systems is blocking its service. Where our network segmentation design includes several mechanisms, the handover explains their separate roles and the evidence needed to troubleshoot each one.
Validate with a controlled enforcement pilot
We begin with a representative set of groups, devices and applications. The pilot checks classification, propagation and the resulting access decision independently. This helps distinguish an incorrectly assigned group from a correct group reaching an unsuitable enforcement point or a policy matrix that does not reflect the business requirement.
Tests include allowed and denied connections, endpoint movement, identity-service disruption where safe, and recovery after the interruption. We document the observed behaviour and any platform-specific limitations. A monitoring or observation stage can reduce risk, but it is not counted as proof that an enforced policy has already been tested in production.
Agree ongoing ownership before expanding
A group-based design needs change control for group definitions, access matrices, exceptions and infrastructure compatibility. We define who reviews new application flows and how a software or hardware change is checked against the established enforcement model. Configuration backups alone do not preserve the reasoning behind the access policy.
MCI can provide TrustSec assessment, architecture and implementation support for a defined Cisco estate. The useful starting information is your topology, access-control objectives and the identity services already in place. We then establish a supported scope, testable acceptance criteria and operational records that allow your team to maintain the policy as the network changes.
Technical references
- Cisco TrustSec configuration guide — Cisco / Cisco Meraki
- Security group access control lists — Cisco / Cisco Meraki
Talk to a specialist
What does your network need next?
Tell us what you are planning, changing or trying to improve. We will help define a practical next step and the engineering scope.
+44 203 196 6566Choose option 1
sales@proxar.co.ukUK-wide service.
Most of our engineers are based in Kent, with a focus on London, Sussex, Essex and Berkshire.
Existing customers should use their agreed support and escalation channels. This form is for service enquiries, not a monitored emergency ticket.
Tell us what you need.
A short outline is enough. Please do not include passwords or sensitive network details.
Thank you. Your enquiry has been submitted.
Please check your name, email and message, then try again.
Your form session expired. Please try again.
Please wait a minute before sending another enquiry.
We could not submit your enquiry. Please call or email us instead.