Connect. Secure. Manage.
SD-Access Segmentation
Implement virtual networks and group-based policies in Cisco SD-Access, with clear access requirements and staged validation of permitted application flows.
Devices supported
across the UK
Client locations
supported
Traffic handled
at peak time
Average
response time
Average response is not a resolution time or a contractual guarantee. Support scope and response commitments are agreed for each engagement.
SD-Access segmentation should make access decisions easier to explain and enforce, not merely produce more virtual networks and security-group tags. MCI Network Services helps organisations translate business relationships into Cisco fabric policy, including the identity, shared-service and operational decisions that sit behind each rule. The work starts with who needs to communicate and ends with evidence that permitted traffic works while inappropriate access is restricted.
Cisco-focused engineering
Design around the platform, traffic and failure behaviour you actually operate.
Change with evidence
Use pre-checks, acceptance criteria and a documented route back.
Operational handover
Keep the configuration, diagrams and responsibilities understandable after delivery.
Define the relationships before naming the groups
We work with application owners, security teams and network engineers to identify the communications that matter. Staff, contractors, guests and operational devices may need different treatment, but job titles alone rarely describe the full requirement. A printer, for example, may need connections to a print service and management platform without being allowed to initiate broad access to user systems.
The output is a traffic and responsibility matrix. It records the source group, destination, required service, business reason and approving owner. Unknown dependencies remain visible for investigation. This is more useful than copying an existing flat network into several groups and permitting everything between them simply to avoid complaints during rollout.
Standards & partnerships
Confidence in the team behind your network.
Cisco Partner
Cisco Meraki
Cyber Essentials
Cyber Essentials PlusMCI Network Services is operated by Proxar Ltd. Certifications apply to the certified legal entity and the scope of its certificates. View accreditation information
Use virtual networks and group policy for different purposes
Virtual networks provide a routing separation mechanism. Group-based controls can provide more detailed policy within the supported fabric design. We choose the combination according to the customer’s requirements and the capabilities of the actual solution. Neither a large number of virtual networks nor a dense policy matrix is an objective in itself.
The design also considers where policy is enforced and what happens outside the fabric. A tag or group assignment is not equivalent to end-to-end inspection. We identify external firewalls, route-leaking points and shared services that affect the boundary. Those connections need coordinated policy rather than an assumption that fabric membership alone protects the complete path.
A useful starting point
Not sure where to start?
Bring the requirement. We will help you define the engineering work.
Make endpoint classification reliable
A policy is only as dependable as the classification that selects it. We review authentication methods, identity sources, certificate deployment and the role of Cisco ISE where required. Managed endpoints and devices without an authentication client may need different onboarding arrangements. Exceptions should be explicit and limited to the access needed by that device.
We also agree failure behaviour. An unavailable authentication service, an expired certificate or an unknown device can each trigger a different response. The business needs to understand the balance between continuity and restricted access. We test those cases rather than relying solely on a successful connection from a correctly configured employee laptop.
Different environments. The same care.
Built around the work
your network supports.
Finance, banking and the wider private sector. We start with the systems and people that depend on your connections.
Finance & banking
Market-data paths, routing and provider coordination on clients’ behalf.
Financial-market services ↗Offices & multi-site teams
Reliable access between people, workplaces and business applications.
Office network design ↗Data centres & cloud
Network boundaries, workload connections and operational ownership.
Data centre networks ↗Introduce restrictions in a controlled sequence
A staged approach can begin with visibility and a limited pilot group before broader enforcement. We use the available evidence to identify legitimate dependencies and confirm proposed rules with their owners. Monitoring traffic can inform the design, but a connection observed once is not automatically a permanent business requirement.
The implementation plan records the policy changes, affected groups and rollback criteria. We avoid several large policy changes at once when a smaller sequence can establish their effect. Temporary exceptions need an owner and review point. Otherwise, a migration intended to improve segmentation can finish with a collection of broad bypasses that nobody wants to remove.
Test the prohibited paths as well as the useful ones
Acceptance includes representative permitted transactions and attempts that should be denied. We check group assignment, the selected policy and the actual packet path. A successful application test proves availability for that case; it does not prove that unrelated destinations are inaccessible.
We also test movement and lifecycle events where relevant. A user changing location, a device being replaced or a contractor’s access being withdrawn can expose weaknesses that a static test misses. Evidence is recorded with the endpoint, policy and conditions so that future reviews can repeat it meaningfully.
Keep administration separate from ordinary access
Network and security administrators need controlled ways to manage the fabric and investigate endpoints. We review those paths separately from user policy, including privileged identities, management systems and emergency procedures. Broad administrative access should not be granted to an ordinary endpoint group for convenience.
The operational model identifies who may create groups, approve rules and change identity mappings. A shared technical platform does not remove the need for separation of duties. Changes should leave an audit trail that connects the business approval to the resulting configuration and test evidence.
Maintain a policy people can understand
MCI’s deliverables can include the approved matrix, group definitions, enforcement map, exceptions register and acceptance record. These support later application changes and onboarding decisions. Segmentation evidence can contribute to a customer’s security programme, but it is not a standalone certification or compliance guarantee.
For the surrounding architecture, see SD-Access fabric design and border integration. A focused segmentation engagement is also suitable for an existing fabric whose policy has become overly permissive or difficult to maintain. The aim is fewer unexplained permissions and clearer ownership, not complexity for its own sake.
Talk to a specialist
What does your network need next?
Tell us what you are planning, changing or trying to improve. We will help define a practical next step and the engineering scope.
+44 203 196 6566Choose option 1
sales@proxar.co.ukUK-wide service.
Most of our engineers are based in Kent, with a focus on London, Sussex, Essex and Berkshire.
Existing customers should use their agreed support and escalation channels. This form is for service enquiries, not a monitored emergency ticket.
Tell us what you need.
A short outline is enough. Please do not include passwords or sensitive network details.
Thank you. Your enquiry has been submitted.
Please check your name, email and message, then try again.
Your form session expired. Please try again.
Please wait a minute before sending another enquiry.
We could not submit your enquiry. Please call or email us instead.