Connect. Secure. Manage.
East-West Network Security
Assess lateral network paths and design Cisco-based controls between workloads, with application dependency mapping and testable access rules.
Devices supported
across the UK
Client locations
supported
Traffic handled
at peak time
Average
response time
Average response is not a resolution time or a contractual guarantee. Support scope and response commitments are agreed for each engagement.
East-west network security controls traffic between internal systems. It matters even when the internet edge is well protected. We map the paths between apps, user networks and management systems, then plan Cisco-led controls for the required flows. The design aims to reduce needless access while preserving the links that daily work relies on.
Defined trust
Make access boundaries explicit rather than relying on an assumed internal network.
Controlled access
Connect identity, policy and network enforcement to the services people actually use.
Evidence for change
Test the intended security outcome and retain useful operational records.
Understand where internal traffic really travels
We map app tiers, user access, management connections and shared infrastructure. The review includes physical switches, virtualisation networks, cloud routes and security devices where they form part of the agreed scope. Traffic between two workloads may never cross the firewall that the customer expects to enforce policy.
This is particularly important when virtual machines share a host or subnet, or when a cloud platform provides its own forwarding paths. We find the actual enforcement opportunities and the boundaries of the network team's control. A physical network review cannot silently claim to cover host-level or application-level connections that it has not examined.
Standards & partnerships
Confidence in the team behind your network.
Cisco Partner
Cisco Meraki
Cyber Essentials
Cyber Essentials PlusMCI Network Services is operated by Proxar Ltd. Certifications apply to the certified legal entity and the scope of its certificates. View accreditation information
Separate useful dependencies from inherited openness
Application owners help establish which systems need to communicate and why. Web, app and database tiers often require different paths from backup, monitoring and admin services. We record the direction and purpose of each important dependency rather than allowing entire server ranges to communicate because they are all labelled production.
Observation provides evidence. But it needs interpretation. A connection seen in a flow log is not automatically legitimate, and a connection absent during a brief observation window is not automatically unnecessary. We combine technical records with operational schedules, recovery procedures and owner confirmation to build a defensible access model.
A useful starting point
Not sure where to start?
Bring the requirement. We will help you define the engineering work.
Choose controls at the right level
The available approach may involve routed zones, firewalls, Cisco group-based policy or other supported enforcement capabilities. Each has different strengths, visibility and operating needs. We assess the customer's platforms and skills before proposing a design, including how policy changes will be approved and investigated.
Granularity is a practical decision. A small number of well-maintained app zones can be more dependable than thousands of rules with no clear owner. Where fine-grained workload controls are justified, the design must explain how workload identity, lifecycle changes and exceptions remain accurate as systems are rebuilt, moved or scaled.
Different environments. The same care.
Built around the work
your network supports.
Finance, banking and the wider private sector. We start with the systems and people that depend on your connections.
Finance & banking
Market-data paths, routing and provider coordination on clients’ behalf.
Financial-market services ↗Offices & multi-site teams
Reliable access between people, workplaces and business applications.
Office network design ↗Data centres & cloud
Network boundaries, workload connections and operational ownership.
Data centre networks ↗Protect management and recovery paths
Privileged management connections can reach many systems and therefore deserve clear treatment. We review the paths used by administrators, automation, backup and monitoring services, distinguishing routine app access from the ability to alter infrastructure. A shared management platform should not become an undocumented route around all other boundaries.
Recovery workflows also need validation. Restricting normal lateral access must not leave the organisation unable to restore a service during an incident. We find the approved recovery connections, their safeguards and how temporary access is withdrawn afterwards. Emergency access is planned as a controlled exception, not as a permanent broad permit.
Introduce enforcement without guessing
A staged rollout begins with a representative app or zone. The pilot compares proposed restrictions with observed and confirmed dependencies, then tests the business workflow under enforcement. The change plan identifies who can approve a temporary exception and how evidence will be collected if a connection fails.
We avoid multiple simultaneous policy changes that make the cause of an outage unclear. Each stage has acceptance criteria and a recovery path. Where a feature offers observation or simulation before enforcement, its results inform the decision. But they do not replace testing the actual permitted and denied traffic once the control is active.
Test lateral restrictions deliberately
Validation checks more than whether the app still works. We test representative paths that should be blocked, including access from ordinary user devices to sensitive administration interfaces. The scope may include alternative routing paths and relevant IPv6 behaviour where enabled, so protection is not assessed only on the most obvious IPv4 route.
Testing is authorised and bounded. The evidence records the source, destination, service and observed enforcement result without implying that every possible lateral movement technique has been assessed. A network-control test is not a substitute for a wider penetration test or an investigation of endpoint compromise.
Make policy ownership part of the result
The handover connects rules to app owners and explains how changes are requested when workloads move or new dependencies appear. Monitoring should help distinguish an intended refusal from a failed service and make unexpected cross-zone access visible. Periodic review is especially valuable after migrations or changes to shared platforms.
Our network segmentation services can provide the wider architecture around east-west controls. MCI can assess current paths, design a targeted improvement or support an internal team implementing the changes. The aim is a maintainable reduction in unnecessary lateral access, with clear evidence of what has been protected and honest boundaries around what remains outside the engagement.
Technical references
- Zero-trust network and cloud design — Cisco / Cisco Meraki
- Network segmentation overview — Cisco / Cisco Meraki
Talk to a specialist
What does your network need next?
Tell us what you are planning, changing or trying to improve. We will help define a practical next step and the engineering scope.
+44 203 196 6566Choose option 1
sales@proxar.co.ukUK-wide service.
Most of our engineers are based in Kent, with a focus on London, Sussex, Essex and Berkshire.
Existing customers should use their agreed support and escalation channels. This form is for service enquiries, not a monitored emergency ticket.
Tell us what you need.
A short outline is enough. Please do not include passwords or sensitive network details.
Thank you. Your enquiry has been submitted.
Please check your name, email and message, then try again.
Your form session expired. Please try again.
Please wait a minute before sending another enquiry.
We could not submit your enquiry. Please call or email us instead.