Connect. Secure. Manage.
Catalyst SD-WAN Segmentation
Design segmented Catalyst SD-WAN connectivity with explicit route sharing, shared-service access and security boundaries between business areas.
Devices supported
across the UK
Client locations
supported
Traffic handled
at peak time
Average
response time
Average response is not a resolution time or a contractual guarantee. Support scope and response commitments are agreed for each engagement.
Catalyst SD-WAN segmentation separates traffic belonging to different users, services or business environments across a supported Cisco WAN. The useful result is controlled connectivity between clearly defined segments, not simply a set of different identifiers in the management platform. MCI Network Services designs and implements segmentation with attention to site routing, shared services, security enforcement and the boundaries where the WAN connects to the rest of the organisation.
The whole path
Understand how sites, providers, cloud networks and security controls fit together.
Resilience that can be tested
Separate a second circuit from genuine end-to-end service resilience.
Provider coordination
Keep addressing, routing and escalation ownership clear across organisations.
Define the segments by purpose and ownership
We establish which networks need separation and why. Corporate users, guest access, operational systems and different business entities may have distinct requirements. The segment model should be understandable to application owners and support engineers, with a clear decision process for adding or changing access.
We also identify cases that do not fit a simple site-wide division. One branch may host several trust zones, while a central service may need to serve more than one segment. These requirements are recorded before configuration begins so the design does not rely on broad exceptions introduced during the first application test.
Standards & partnerships
Confidence in the team behind your network.
Cisco Partner
Cisco Meraki
Cyber Essentials
Cyber Essentials PlusMCI Network Services is operated by Proxar Ltd. Certifications apply to the certified legal entity and the scope of its certificates. View accreditation information
Map local networks to the intended WAN context
Segmentation starts at the site interface and gateway, not only inside the overlay. We review VLANs, routing contexts and service-side connections on the WAN edges. The same identifier used at two sites should represent the same intended purpose, while local differences need an explicit mapping and owner.
Addressing is checked at the same time. Overlapping prefixes can be supported in some separated designs, but they complicate shared access, monitoring and troubleshooting. We assess those consequences rather than assuming separate segments make address overlap harmless wherever traffic eventually needs to meet.
A useful starting point
Not sure where to start?
Bring the requirement. We will help you define the engineering work.
Control route distribution deliberately
The design specifies which routes belong to each segment and where they should be available. We examine central policy and site-side routing together, including default routes and any exchange with existing OSPF, BGP or static domains. A route advertised into the wrong context can undermine the intended separation even when interface assignments appear correct.
Route exchange between segments requires a defined purpose. We identify the exact shared destinations and the enforcement point governing their use. Unrestricted leaking of routes is not treated as a convenient substitute for a shared-services design, because reachability and permission are separate decisions that need to remain visible.
Different environments. The same care.
Built around the work
your network supports.
Finance, banking and the wider private sector. We start with the systems and people that depend on your connections.
Finance & banking
Market-data paths, routing and provider coordination on clients’ behalf.
Financial-market services ↗Offices & multi-site teams
Reliable access between people, workplaces and business applications.
Office network design ↗Data centres & cloud
Network boundaries, workload connections and operational ownership.
Data centre networks ↗Place security enforcement at the boundary
Logical separation in the WAN does not automatically enforce every application restriction. Firewalls, access lists or other supported policy mechanisms may govern connections between segments and external services. We map the actual traffic path and verify that it crosses the intended control in both directions.
This includes cloud connections and central hubs. A carefully separated branch design can become unrestricted when all traffic reaches a shared gateway with permissive policy. Our shared services network access work addresses those controlled exceptions and helps distinguish necessary infrastructure access from unintended transit between trust zones.
Plan migration and operational exceptions
Introducing segmentation into a live WAN can alter route visibility and application paths. We prepare a staged approach, beginning with a representative site or service group and validating its dependencies. The transition identifies temporary routing and policy arrangements, together with the conditions for removing them.
Rollback considers both the WAN and the local network. Restoring a central policy may not recover an application if its gateway or firewall rule changed during the same window. We document the complete recovery sequence and ensure the teams needed to validate it are available when enforcement is introduced.
Prove isolation as well as connectivity
Acceptance tests include legitimate workflows within each segment and approved shared-service access. They also test representative connections that should remain blocked. Source positions, destinations and the relevant enforcement points are recorded so the results can be repeated after a later change.
We examine failure and restoration where safe, including whether an alternative route preserves the same boundary. A backup path that bypasses inspection may restore connectivity while violating the security design. Any untested scenario or platform limitation is stated explicitly rather than included in a blanket claim of end-to-end isolation.
Keep the segment model consistent over time
The handover contains the segment register, site mappings, route policies, shared-service exceptions and ownership. New sites and applications should follow that model instead of adding local shortcuts. Monitoring needs enough context to identify which segment is affected when a route or service fails.
MCI can review an existing deployment or implement segmentation within an agreed Catalyst SD-WAN architecture. Share the zones, applications and interconnections you need to control. We can turn those requirements into supported configuration and testable boundaries without implying that a WAN feature alone satisfies every security or compliance obligation of the organisation.
Technical references
- Cisco Catalyst SD-WAN design guide — Cisco / Cisco Meraki
- Configuration-group service profiles — Cisco / Cisco Meraki
Talk to a specialist
What does your network need next?
Tell us what you are planning, changing or trying to improve. We will help define a practical next step and the engineering scope.
+44 203 196 6566Choose option 1
sales@proxar.co.ukUK-wide service.
Most of our engineers are based in Kent, with a focus on London, Sussex, Essex and Berkshire.
Existing customers should use their agreed support and escalation channels. This form is for service enquiries, not a monitored emergency ticket.
Tell us what you need.
A short outline is enough. Please do not include passwords or sensitive network details.
Thank you. Your enquiry has been submitted.
Please check your name, email and message, then try again.
Your form session expired. Please try again.
Please wait a minute before sending another enquiry.
We could not submit your enquiry. Please call or email us instead.