Connect. Secure. Manage.
Site-to-Site IPsec Services
Design Cisco or Meraki site-to-site IPsec connectivity with supported peer settings, routing, cryptography and a clear troubleshooting handover.
Devices supported
across the UK
Client locations
supported
Traffic handled
at peak time
Average
response time
Average response is not a resolution time or a contractual guarantee. Support scope and response commitments are agreed for each engagement.
Site-to-site IPsec services link networks over an untrusted transport using agreed encryption and identity checks. We design and troubleshoot Cisco and Meraki tunnels with routes, security rules and app paths in mind. Both ends must support the chosen features. Tests check useful service through the tunnel, beyond whether the tunnel itself is up.
The whole path
Understand how sites, providers, cloud networks and security controls fit together.
Resilience that can be tested
Separate a second circuit from genuine end-to-end service resilience.
Provider coordination
Keep addressing, routing and escalation ownership clear across organisations.
Define the networks and services that need access
We start with the source and destination address ranges, required apps and the organisations controlling each endpoint. The connection may link company offices, a cloud setup or a partner service. Each case needs a clear access boundary. Encrypting traffic between two devices does not mean every network behind those devices should become reachable.
Address overlap is checked before setup. Translation may be necessary in some designs. But it can affect traffic selectors, firewall rules and troubleshooting. We document the original and translated addresses and involve app owners where they depend on fixed values. This avoids building a tunnel that establishes successfully while the intended app traffic never matches its policy.
Standards & partnerships
Confidence in the team behind your network.
Cisco Partner
Cisco Meraki
Cyber Essentials
Cyber Essentials PlusMCI Network Services is operated by Proxar Ltd. Certifications apply to the certified legal entity and the scope of its certificates. View accreditation information
Agree compatible peer settings
The peer specification covers the supported IKE version, authentication method, cryptographic proposals, lifetimes and relevant negotiation behaviour. We select settings that meet the customer’s security needs and are supported by both products and releases. Secrets or private keys are exchanged only through an agreed protected method, never embedded in a public enquiry or ordinary project document.
Cisco route-based and policy-based arrangements, Meraki non-Meraki peer settings and cloud VPN gateways can have different restrictions. We check the actual combination, including supported routing and high-availability behaviour. A setup example for a different device family is not treated as proof of compatibility. Any required licence or platform dependency is recorded before the rollout window.
A useful starting point
Not sure where to start?
Bring the requirement. We will help you define the engineering work.
Integrate routing and security deliberately
The design sets out how traffic is directed into the tunnel and what happens when the peer is unavailable. Static routes, supported dynamic routing and tracking mechanisms are assessed for the chosen platform. We do not leave a permanent route attracting traffic into an unusable path without considering the required failure response.
Firewalls must allow the intended encrypted transport and the approved traffic inside it. We also review NAT traversal, public-address ownership and any upstream device that can alter the connection. Return traffic is traced through the remote network because a one-way route or policy mismatch can look like an IPsec fault even when negotiation is healthy. Application testing therefore remains essential.
Different environments. The same care.
Built around the work
your network supports.
Finance, banking and the wider private sector. We start with the systems and people that depend on your connections.
Finance & banking
Market-data paths, routing and provider coordination on clients’ behalf.
Financial-market services ↗Offices & multi-site teams
Reliable access between people, workplaces and business applications.
Office network design ↗Data centres & cloud
Network boundaries, workload connections and operational ownership.
Data centre networks ↗Account for overhead and real throughput
Encryption and encapsulation add overhead, and the practical performance depends on the endpoint hardware, software, traffic mix and chosen features. We compare the need with supported capacity rather than relying on a headline interface speed. A faster internet circuit may not improve a tunnel limited by the security appliance’s processing capabilities.
MTU and fragmentation deserve particular attention when small tests work but larger transactions fail. We investigate path behaviour and appropriate supported adjustments rather than applying a blanket value copied from another setup. Loss, rekeying and asymmetric paths can also affect the user experience. The proposal defines the measurements needed to establish whether the tunnel meets the app’s throughput and stability needs.
Deploy with usable recovery access
Before changing production VPN policy, we capture the current state and confirm an alternative way to reach the equipment. Both organisations agree the change sequence and are available to check their side. The plan defines rollback conditions and avoids leaving half of a paired change active when the remote team cannot complete its work.
Acceptance includes negotiation, counters, routing, permitted app flows and prohibited access where practical. We test re-establishment or agreed failover scenarios without assuming that a stable first connection proves long-term behaviour. The handover records the peer identifiers, policy boundaries and verification steps, but keeps authentication material in the authorised secrets system rather than duplicating it in the report.
Troubleshoot and maintain the connection
For current faults, we separate negotiation failures from forwarding problems. Logs, security-association state, packet counters and route information help identify whether traffic is reaching the tunnel, being encrypted and returning correctly. We avoid clearing sessions repeatedly before collecting evidence. A restart can conceal a recurring mismatch without resolving its cause.
MCI’s Cisco and Meraki network services support UK organisations with branch, cloud and partner VPN needs. Ongoing care can include certificate or secret rotation planning, software lifecycle review and changes to remote networks. Our private network interconnect service helps determine when IPsec is the appropriate transport and when another arrangement better fits the business need. Share the peer platforms and required networks to begin a scoped assessment.
Talk to a specialist
What does your network need next?
Tell us what you are planning, changing or trying to improve. We will help define a practical next step and the engineering scope.
+44 203 196 6566Choose option 1
sales@proxar.co.ukUK-wide service.
Most of our engineers are based in Kent, with a focus on London, Sussex, Essex and Berkshire.
Existing customers should use their agreed support and escalation channels. This form is for service enquiries, not a monitored emergency ticket.
Tell us what you need.
A short outline is enough. Please do not include passwords or sensitive network details.
Thank you. Your enquiry has been submitted.
Please check your name, email and message, then try again.
Your form session expired. Please try again.
Please wait a minute before sending another enquiry.
We could not submit your enquiry. Please call or email us instead.