Connect. Secure. Manage.
Cisco Remote Access VPN Design
Design Cisco remote-access VPN services around user groups, applications, routing and capacity, with authentication and recovery considered together.
Devices supported
across the UK
Client locations
supported
Traffic handled
at peak time
Average
response time
Average response is not a resolution time or a contractual guarantee. Support scope and response commitments are agreed for each engagement.
Cisco remote access VPN design plans how approved users reach business systems from elsewhere. We set out who can connect, what they can reach and how the service handles load or faults. The supported Cisco design covers identity, devices, routes and app paths. It also names who will operate and recover each part of the service.
Defined trust
Make access boundaries explicit rather than relying on an assumed internal network.
Controlled access
Connect identity, policy and network enforcement to the services people actually use.
Evidence for change
Test the intended security outcome and retain useful operational records.
Define the user and application scope
We start with the user groups, devices and destinations the VPN must support. Employees, contractors and administrators may need different authorisation policies even when they share the same gateway. We find the apps, protocols and infrastructure dependencies involved, including internal DNS, authentication and any specialist systems with unusual connection behaviour.
The expected workload is recorded in practical terms. Concurrent users, traffic patterns, encryption and inspection needs all influence capacity. A nominal session limit from a specification is not a guarantee that a chosen device will meet the customer's performance expectations with every proposed feature enabled.
Standards & partnerships
Confidence in the team behind your network.
Cisco Partner
Cisco Meraki
Cyber Essentials
Cyber Essentials PlusMCI Network Services is operated by Proxar Ltd. Certifications apply to the certified legal entity and the scope of its certificates. View accreditation information
Select the supported gateway arrangement
We review the current Cisco platform, software and licences alongside the proposed access needs. Physical, virtual and cloud-delivered arrangements can have different capabilities and resilience models. The design sets out the exact supported combination rather than assuming that a setup used on one gateway can be transferred unchanged to another.
Public addressing, DNS and certificates are part of that choice. Users need a dependable service name and a valid trust relationship with the gateway. We also consider how provider changes or disaster recovery will affect the advertised endpoint, including any dependency on an external firewall or address translation device.
A useful starting point
Not sure where to start?
Bring the requirement. We will help you define the engineering work.
Connect authentication with least-privilege access
The design specifies the identity source, supported authentication workflow and group mapping. Multi-factor authentication is assessed with enrolment, recovery and failure behaviour, not merely the successful login path. Where client certificates or device checks are required, their rollout and lifecycle duties are included clearly.
Authorisation then limits the networks and services available to each group. A person who is allowed to establish a tunnel should not automatically receive unrestricted internal reachability. We set out the relevant access policies and check how they interact with downstream firewalls and app permissions.
Different environments. The same care.
Built around the work
your network supports.
Finance, banking and the wider private sector. We start with the systems and people that depend on your connections.
Finance & banking
Market-data paths, routing and provider coordination on clients’ behalf.
Financial-market services ↗Offices & multi-site teams
Reliable access between people, workplaces and business applications.
Office network design ↗Data centres & cloud
Network boundaries, workload connections and operational ownership.
Data centre networks ↗Design the routing and DNS experience
Split-tunnel and full-tunnel approaches affect security inspection, bandwidth and user experience. We assess the organisation's policy and app needs, then document which traffic uses the VPN and which remains local. A tunnel cannot inspect or protect traffic that is deliberately routed elsewhere unless another control provides that function.
DNS setup must support the intended private names without creating avoidable failures for public services. We also consider overlapping address ranges, local network access and apps that depend on multiple destinations. The design should explain both the forward path and the return route from internal systems to the remote-user address pool.
Build resilience around real dependencies
A second gateway can provide an alternative endpoint. But it does not remove shared dependencies on identity, DNS, certificates or upstream network access. We map those dependencies and identify what remains available during each agreed failure scenario. Session continuity and user reconnection are treated separately; not every redundancy design preserves established sessions.
The service also needs planned maintenance. Upgrades, new certificates and rule changes must leave a usable recovery route. We agree the outage window, notices to users and the point at which to roll back. A high-availability design can help with faults, but it does not remove the need to maintain the service.
Validate security and application operation together
Acceptance tests cover representative users, supported devices and important apps from external networks. We check successful access and deliberate refusals, including a user assigned to the wrong or insufficient group. Tests also examine the treatment of failed authentication, unavailable dependencies and recovery where safe.
Performance checks use realistic workflows rather than only a gateway ping or a large-file transfer. Voice, interactive sessions and apps with multiple connections can respond differently to latency and packet loss. The record states the conditions tested and avoids extending a limited result into a universal service guarantee.
Hand over a service, not just a configuration
The handover names the gateway owner and records client delivery, address pools, policy groups, certificate renewal and escalation contacts. Alerts should tell the right team about capacity pressure, failed sign-ins and lost backup paths. We agree who may read logs and how long they are kept. Those records can identify users and their activity.
Our secure remote access services can cover the broader choice between network-level and application-specific access. MCI can prepare a new Cisco VPN design or review a current service with recurring faults. Share your user population, apps and availability expectations so we can define a supported architecture and measurable acceptance criteria before rollout.
Technical references
- Cisco Secure Client VPN configuration — Cisco / Cisco Meraki
- Cisco Secure Client profile editor — Cisco / Cisco Meraki
Talk to a specialist
What does your network need next?
Tell us what you are planning, changing or trying to improve. We will help define a practical next step and the engineering scope.
+44 203 196 6566Choose option 1
sales@proxar.co.ukUK-wide service.
Most of our engineers are based in Kent, with a focus on London, Sussex, Essex and Berkshire.
Existing customers should use their agreed support and escalation channels. This form is for service enquiries, not a monitored emergency ticket.
Tell us what you need.
A short outline is enough. Please do not include passwords or sensitive network details.
Thank you. Your enquiry has been submitted.
Please check your name, email and message, then try again.
Your form session expired. Please try again.
Please wait a minute before sending another enquiry.
We could not submit your enquiry. Please call or email us instead.