Connect. Secure. Manage.
Cisco EVPN Tenant Segmentation
Separate tenants and applications within Cisco EVPN fabrics, with explicit route leaking, shared-service access and external connectivity.
Devices supported
across the UK
Client locations
supported
Traffic handled
at peak time
Average
response time
Average response is not a resolution time or a contractual guarantee. Support scope and response commitments are agreed for each engagement.
Cisco EVPN tenant segmentation separates workload routing and connectivity within a shared fabric while allowing explicitly approved services to cross the boundary. The design needs more than a list of VNIs. MCI Network Services develops Cisco EVPN segmentation models with clear tenant ownership, route policy and security enforcement. We help customers understand what the fabric isolates, what remains shared and how that separation will be verified after deployment.
Workload-led design
Start with application, compute and storage dependencies rather than the switch model.
Clear failure domains
Understand which links, devices and sites can fail together.
Operational clarity
Make fabrics, external routing and management responsibilities supportable.
Define the boundary the business actually needs
A tenant may represent a customer, application environment, business unit or other administrative domain. We establish the purpose of separation and the people authorised to approve changes. Different tenant names do not automatically imply different risk requirements, and an organisational chart is not always the best guide to a routing design.
The assessment identifies workloads, address ranges, management access and supporting services. We record which communication is required within a tenant and which must cross to another domain. The customer validates this access model before route leaking or shared-service connectivity is configured. This avoids using a broad network connection to compensate for an application requirement that has not been properly described.
Standards & partnerships
Confidence in the team behind your network.
Cisco Partner
Cisco Meraki
Cyber Essentials
Cyber Essentials PlusMCI Network Services is operated by Proxar Ltd. Certifications apply to the certified legal entity and the scope of its certificates. View accreditation information
Align routing contexts and overlay identifiers
We define the relationship between tenant VRFs, VLANs, VNIs and the EVPN routes exchanged by the fabric. Route-target policy is reviewed for the intended import and export behaviour, while other identifiers are assigned according to their actual role. A consistent allocation scheme makes configuration and future expansion easier to audit.
The design is checked against the supported scale and feature combination of the selected Cisco platform. Shared hardware resources can impose limits even when tenants are logically separate. We document those constraints and the monitoring needed to recognise pressure before it affects service. Logical isolation should not be mistaken for independent capacity or a guarantee that one tenant’s demand cannot influence shared infrastructure.
A useful starting point
Not sure where to start?
Bring the requirement. We will help you define the engineering work.
Design shared services explicitly
DNS, identity, monitoring, backup and other common services may need controlled access from several tenants. We identify the exact prefixes and application flows required, then select supported route-leaking and security arrangements. The fact that a service is shared does not justify unrestricted access to the network in which it resides.
Overlapping addresses require particular care. A design that permits address reuse must also explain how shared services, logging and administration distinguish the tenants. Translation or other integration may be necessary, with its own operational implications. We do not introduce overlap merely because the routing technology can represent it; the customer needs a workable end-to-end service and support model.
Different environments. The same care.
Built around the work
your network supports.
Finance, banking and the wider private sector. We start with the systems and people that depend on your connections.
Finance & banking
Market-data paths, routing and provider coordination on clients’ behalf.
Financial-market services ↗Offices & multi-site teams
Reliable access between people, workplaces and business applications.
Office network design ↗Data centres & cloud
Network boundaries, workload connections and operational ownership.
Data centre networks ↗Preserve security at the fabric borders
External routing can undermine otherwise sound tenant separation if prefixes are merged or exported too broadly. We review border-leaf policy, firewall paths and the treatment of default routes. Each external connection has an owner and an authorised route set. The fabric should not become unintended transit between customers, partners or security zones.
Routing separation is one layer of control. Where inspection, application filtering or encryption is required, those functions are designed and documented separately. We avoid describing a VRF or VNI as a complete security programme. The customer receives a clear account of the controls implemented by the network and the complementary responsibilities of endpoint, application and security teams.
Test intended access and deliberate isolation
Acceptance demonstrates both what works and what should remain unavailable. We select representative endpoints and approved cross-tenant services, then perform authorised negative tests against prohibited paths. The tests trace routing and policy in both directions so that a one-way block or an unexpected return route is not mistaken for complete isolation.
Failure and change scenarios are included where relevant. A tenant may be correctly separated during normal operation but exposed by a backup route or temporary migration connection. We review those paths and record the tested behaviour. Any exception has a documented owner, purpose and review condition rather than being left as an unexplained broad import policy.
Keep tenant lifecycle changes controlled
Adding a tenant, moving an application or retiring a customer requires updates to routes, access rules, monitoring and documentation. We define a repeatable process and checks for residual connectivity. Configuration automation can help maintain standards, but it must use an approved source of intent and should not silently repair perceived drift without authorisation.
MCI can design segmentation for a new fabric or review an existing Cisco EVPN estate. Related work includes border leaf integration and network segmentation. Share the tenant model, required shared services and present routing boundaries to begin. The deliverable will identify supported controls, operational dependencies and the evidence needed to substantiate the intended separation.
Talk to a specialist
What does your network need next?
Tell us what you are planning, changing or trying to improve. We will help define a practical next step and the engineering scope.
+44 203 196 6566Choose option 1
sales@proxar.co.ukUK-wide service.
Most of our engineers are based in Kent, with a focus on London, Sussex, Essex and Berkshire.
Existing customers should use their agreed support and escalation channels. This form is for service enquiries, not a monitored emergency ticket.
Tell us what you need.
A short outline is enough. Please do not include passwords or sensitive network details.
Thank you. Your enquiry has been submitted.
Please check your name, email and message, then try again.
Your form session expired. Please try again.
Please wait a minute before sending another enquiry.
We could not submit your enquiry. Please call or email us instead.