Connect. Secure. Manage.
Access Manager MAC Authentication
Handle devices that cannot use enterprise authentication through controlled MAC-based exceptions, with clear limits and compensating controls.
Devices supported
across the UK
Client locations
supported
Traffic handled
at peak time
Average
response time
Average response is not a resolution time or a contractual guarantee. Support scope and response commitments are agreed for each engagement.
Access Manager MAC authentication can provide an admission path for supported wired endpoints that cannot use a stronger enterprise authentication method. It checks a device identifier against the configured access policy; it does not turn that identifier into a secret. MCI Network Services implements MAC-based exceptions with limited permissions, owned records and clear replacement procedures so that necessary equipment can connect without creating a broad, permanent bypass.
Defined trust
Make access boundaries explicit rather than relying on an assumed internal network.
Controlled access
Connect identity, policy and network enforcement to the services people actually use.
Evidence for change
Test the intended security outcome and retain useful operational records.
Decide whether a MAC-based exception is justified
We first verify whether the endpoint genuinely lacks a suitable supplicant or certificate workflow. Some devices are capable of stronger authentication but have never been configured for it. Where that is practical, a certificate-based approach may be preferable to extending an address allow list.
For equipment that needs an exception, we record the business purpose, owner and expected location. The customer should know why the device is allowed and which service depends on it. An unknown endpoint is not approved simply because blocking it would be inconvenient during discovery. Temporary access is treated as a separate, time-bound decision.
Standards & partnerships
Confidence in the team behind your network.
Cisco Partner
Cisco Meraki
Cyber Essentials
Cyber Essentials PlusMCI Network Services is operated by Proxar Ltd. Certifications apply to the certified legal entity and the scope of its certificates. View accreditation information
Understand what the identifier proves
A MAC address is observable and can be imitated. Matching one therefore provides limited assurance about the physical device presenting it. The access policy must account for that limitation rather than describing a successful match as proof that the endpoint is secure or managed.
We discuss the consequences of a copied identifier and reduce the available access accordingly. A printer exception might need a small set of application and management paths, not the same permissions as an administrator's workstation. The design combines admission with segmentation and monitoring, while making clear that those measures do not transform MAC matching into cryptographic authentication.
A useful starting point
Not sure where to start?
Bring the requirement. We will help you define the engineering work.
Confirm the supported wired workflow
We verify the switch model, firmware, management mode and Access Manager configuration. The relevant port-access policy and any interaction with 802.1X are checked against current platform support. The service is not assumed to behave identically across every Meraki or Cisco switch simply because the devices share a dashboard.
Port roles matter. A single endpoint, a phone with a workstation behind it and an infrastructure uplink need different treatment. We identify where the MAC-based method is allowed and where it must never become an automatic fallback. The result is documented at the interface or policy-group level so later changes do not broaden it accidentally.
Different environments. The same care.
Built around the work
your network supports.
Finance, banking and the wider private sector. We start with the systems and people that depend on your connections.
Finance & banking
Market-data paths, routing and provider coordination on clients’ behalf.
Financial-market services ↗Offices & multi-site teams
Reliable access between people, workplaces and business applications.
Office network design ↗Data centres & cloud
Network boundaries, workload connections and operational ownership.
Data centre networks ↗Maintain a useful endpoint register
An allow list should identify more than the address. We include the owner, role, location, approval and review point in the customer's operating records. Duplicate or stale entries are investigated, especially where equipment moves between sites or replacement devices inherit a previous function.
Importing an existing inventory requires validation. A spreadsheet may contain retired equipment, virtual interfaces or addresses recorded from the wrong adapter. We agree a sample check and a process for resolving uncertain records before using them for access decisions. The customer retains ownership of approval; MCI can prepare and validate the technical policy without inventing that authority.
Apply the narrowest useful permission
We map approved endpoint groups to supported authorisation results and verify the network path behind them. Address assignment, gateway reachability and firewall controls must agree with the intended role. A successful admission followed by unrestricted routing would defeat the purpose of treating the endpoint as an exception.
Negative tests are important. We test an unregistered identifier and an approved device attempting an unauthorised path, within the agreed scope. Where safe, we also examine what happens when the same identifier appears unexpectedly elsewhere. The report distinguishes platform detection capabilities from controls that require an external operational process.
Control fallback and service outages
A method intended for a small device population should not become the universal answer when another authentication service fails. We review rule ordering, default behaviour and the treatment of missing context. An explicit denial should remain distinct from an unavailable dependency.
The outage procedure states who can approve temporary access and how it will be removed. Restoration includes checking that devices return to their intended policy and that no broad exception remains. This prevents a short incident from quietly changing the long-term security model of the access network.
Review and retire exceptions
MCI provides the configured scope, test evidence and an operating procedure for additions, replacements and removals. Periodic review can identify equipment that now supports a stronger method or no longer needs network access. For the broader design, Access Manager IoT Authentication explains how admission, segmentation and lifecycle ownership fit together. The aim is a controlled exception with a known risk, not an endlessly growing list of addresses that nobody is willing to remove.
Technical references
- Cisco Access Manager deployment guide — Cisco / Cisco Meraki
Talk to a specialist
What does your network need next?
Tell us what you are planning, changing or trying to improve. We will help define a practical next step and the engineering scope.
+44 203 196 6566Choose option 1
sales@proxar.co.ukUK-wide service.
Most of our engineers are based in Kent, with a focus on London, Sussex, Essex and Berkshire.
Existing customers should use their agreed support and escalation channels. This form is for service enquiries, not a monitored emergency ticket.
Tell us what you need.
A short outline is enough. Please do not include passwords or sensitive network details.
Thank you. Your enquiry has been submitted.
Please check your name, email and message, then try again.
Your form session expired. Please try again.
Please wait a minute before sending another enquiry.
We could not submit your enquiry. Please call or email us instead.