Connect. Secure. Manage.
Meraki Campus Fabric Segmentation
Design segmentation for a supported cloud-managed campus fabric, defining user groups, network boundaries and required communication between services.
Devices supported
across the UK
Client locations
supported
Traffic handled
at peak time
Average
response time
Average response is not a resolution time or a contractual guarantee. Support scope and response commitments are agreed for each engagement.
Meraki campus fabric segmentation sets which users and devices can reach each service. We map required traffic to supported routing and access controls. Tests check both allowed and blocked flows. The design distinguishes broad network boundaries from rules based on identity, so your team knows what each control does as the site changes.
Dashboard clarity
Structure organisations, networks and permissions around real operational ownership.
Consistent sites
Use repeatable standards without ignoring the differences between locations.
Practical operations
Keep cloud management connected to physical links, users and business services.
Describe the access requirement in business terms
A useful segmentation project begins with conversations about services, not a list of VLAN numbers. We identify staff groups, contractors, visitors, operational devices and the apps they need. We also establish who owns the data or process behind each service and who can approve access. These decisions cannot be delegated entirely to a network setup template.
The resulting flow register records source groups, destinations, required protocols and the reason for access. It includes less visible dependencies such as DNS, authentication, time and management services. Without those details, a restrictive policy can interrupt ordinary work, leading engineers to add broad exceptions that undermine the original aim. We prefer a smaller, understood policy over a large rule set with no accountable owners.
Standards & partnerships
Confidence in the team behind your network.
Cisco Partner
Cisco Meraki
Cyber Essentials
Cyber Essentials PlusMCI Network Services is operated by Proxar Ltd. Certifications apply to the certified legal entity and the scope of its certificates. View accreditation information
Separate routing boundaries from policy enforcement
Supported fabric designs can use separate routing contexts for broad isolation and group-based controls for more detailed decisions where the platform supports them. We assess the available capabilities for the exact hardware, software and licences. The design sets out where group information is assigned, transported and enforced rather than assuming that a label automatically has the same effect everywhere.
Traffic leaving the fabric requires its own treatment. A tag or routing context may not be understood by every external device. We set out how the intended policy is maintained at firewalls, WAN edges and shared-service boundaries. The customer receives an end-to-end explanation of the separation, not a claim that security continues automatically beyond the supported enforcement domain.
A useful starting point
Not sure where to start?
Bring the requirement. We will help you define the engineering work.
Handle endpoints that do not fit the ideal model
Some devices cannot use the preferred authentication method or do not provide a reliable identity signal. Printers, building controllers and specialist equipment need deliberate handling rather than being placed in an unrestricted exception group. We check what can be established about each population and choose a proportionate supported access method with clear limitations.
Exceptions should have an owner, a reason and a review point. Where a temporary rule is necessary to maintain service during migration, we record the affected flows and the evidence needed to replace it. This prevents a carefully designed policy from gradually becoming permissive through undocumented operational shortcuts, especially when several teams can request or implement changes.
Different environments. The same care.
Built around the work
your network supports.
Finance, banking and the wider private sector. We start with the systems and people that depend on your connections.
Finance & banking
Market-data paths, routing and provider coordination on clients’ behalf.
Financial-market services ↗Offices & multi-site teams
Reliable access between people, workplaces and business applications.
Office network design ↗Data centres & cloud
Network boundaries, workload connections and operational ownership.
Data centre networks ↗Plan shared services and administrative access
Shared infrastructure often creates the hardest segmentation questions. Multiple groups may need DNS, DHCP, printing or a common app. But that does not justify unrestricted communication between all of them. We map the specific service paths and decide where inspection or extra policy is required. The design should make those dependencies visible to both network and app owners.
Administrative access is reviewed separately from ordinary user traffic. Support teams may need controlled access across several segments. But the path should be limited, attributable and appropriate to their role. We identify how monitoring, setup and emergency access will operate without making the management network a convenient bypass around the rest of the segmentation design.
Test positive and negative cases
Acceptance testing checks that authorised activity works and that unauthorised paths remain blocked. We choose representative endpoints and app flows, including access after a device moves or reconnects where relevant. A successful login or assigned group is not enough. The observed forwarding and enforcement must match the policy the customer approved.
We also consider failure conditions. An unavailable identity dependency or a change in endpoint classification should have a documented outcome. Where the platform offers different fallback behaviours, the choice needs business approval because availability and isolation can pull in different directions. Test evidence states the conditions used and any gaps that cannot be exercised safely in the production setup.
Keep the policy understandable after deployment
The handover includes the access matrix, enforcement boundaries, exception register and change process. Monitoring should help engineers distinguish an intentional denial from a network access fault. We agree what information may be retained for troubleshooting and who can access it, taking account of the sensitivity of identity and traffic records.
MCI can deliver segmentation alongside Meraki campus fabric design or review a deployed policy independently. The work can support a wider security programme by producing useful network evidence. But it is not a certification or a guarantee that every attack path has been removed. Its value is a defined, tested access model with clear ownership and a practical way to keep it current.
Technical references
- Cloud-managed EVPN fabric technical guide — Cisco / Cisco Meraki
- Adaptive Policy configuration guide — Cisco / Cisco Meraki
Talk to a specialist
What does your network need next?
Tell us what you are planning, changing or trying to improve. We will help define a practical next step and the engineering scope.
+44 203 196 6566Choose option 1
sales@proxar.co.ukUK-wide service.
Most of our engineers are based in Kent, with a focus on London, Sussex, Essex and Berkshire.
Existing customers should use their agreed support and escalation channels. This form is for service enquiries, not a monitored emergency ticket.
Tell us what you need.
A short outline is enough. Please do not include passwords or sensitive network details.
Thank you. Your enquiry has been submitted.
Please check your name, email and message, then try again.
Your form session expired. Please try again.
Please wait a minute before sending another enquiry.
We could not submit your enquiry. Please call or email us instead.