Connect. Secure. Manage.
Access Manager Policy Design
Translate user and device access requirements into Cisco Access Manager policies, including precedence, exceptions and staged enforcement.
Devices supported
across the UK
Client locations
supported
Traffic handled
at peak time
Average
response time
Average response is not a resolution time or a contractual guarantee. Support scope and response commitments are agreed for each engagement.
Access Manager policy design turns a business access requirement into rules that can be evaluated and enforced consistently. The difficult part is usually deciding which evidence is trustworthy, which permission is appropriate and what happens when information is missing. MCI Network Services designs Cisco Access Manager policies for supported Meraki-managed environments, making the rule logic understandable to the engineers who will maintain it after deployment.
Defined trust
Make access boundaries explicit rather than relying on an assumed internal network.
Controlled access
Connect identity, policy and network enforcement to the services people actually use.
Evidence for change
Test the intended security outcome and retain useful operational records.
Write the access matrix before the rules
We identify the user and device populations, their authentication methods and the services they need. The matrix separates staff, visitors, non-user equipment and administrative workflows where relevant. It also records what should happen to an unknown or incorrectly configured endpoint rather than leaving that result to an unexplained default.
Permissions are described in business and technical terms. A role called contractor is not enough unless the customer can say which applications that role may reach. We map those requirements to supported enforcement outcomes and the network boundaries behind them. This keeps policy discussion focused on access rather than on the visual arrangement of rules in the dashboard.
Standards & partnerships
Confidence in the team behind your network.
Cisco Partner
Cisco Meraki
Cyber Essentials
Cyber Essentials PlusMCI Network Services is operated by Proxar Ltd. Certifications apply to the certified legal entity and the scope of its certificates. View accreditation information
Use attributes that the request actually contains
Different authentication methods supply different context. A machine certificate, a user certificate and a MAC-based request should not be assumed to expose the same identity information. We verify the available attributes and any external lookups before building conditions around them.
Each attribute has an owner and a level of confidence. A directory group may be authoritative for a user role, while a device characteristic may only suggest a likely equipment type. We record that distinction and avoid using weak context to justify highly privileged access. Where the required information is unavailable, the design identifies an alternative method or a narrower permission.
A useful starting point
Not sure where to start?
Bring the requirement. We will help you define the engineering work.
Make ordering and defaults explicit
Access Manager evaluates its supported rule structure in a defined order. We review the available condition logic and ensure that each rule has a clear purpose. Broad matches should not obscure more specific restrictions or rely on assumptions about why an earlier rule was not selected.
Missing attributes and unavailable external dependencies need particular attention. We design rules so that the absence of a lookup result does not unintentionally create permission through a later fallback. The default result is stated, approved and tested. A temporary monitoring policy is marked as transitional rather than presented as an enforced access boundary.
Different environments. The same care.
Built around the work
your network supports.
Finance, banking and the wider private sector. We start with the systems and people that depend on your connections.
Finance & banking
Market-data paths, routing and provider coordination on clients’ behalf.
Financial-market services ↗Offices & multi-site teams
Reliable access between people, workplaces and business applications.
Office network design ↗Data centres & cloud
Network boundaries, workload connections and operational ownership.
Data centre networks ↗Separate admission from downstream restriction
An access decision may return a VLAN, group policy or other supported result, but the surrounding network must implement it. We review addressing, switch paths, gateways and firewall rules associated with each outcome. A correctly selected rule can still lead to the wrong access when an enforcement dependency is missing.
The policy documentation therefore includes a path to the actual control point. We identify where traffic is restricted and which team owns that configuration. This avoids a common gap in which the identity team assumes the network is filtering while the network team assumes the identity result itself is the filter.
Keep exceptions small and explainable
Exceptions are sometimes necessary for equipment limitations, temporary migrations or a specific business process. We record the owner, reason, permission and review date. An exception should not be broader than the requirement it solves, and it should not become the only way an important service can operate indefinitely.
We also examine how exceptions interact with normal rules. A device that changes location or receives a stronger credential should not unexpectedly match an old permissive record. The review includes stale entries and overlapping groups so that the rule set remains understandable as the organisation changes.
Test decisions as a matrix
Acceptance uses representative cases for every important rule and default. We include valid users, incorrect groups, untrusted credentials, unknown devices and missing context where safe to simulate. The record compares the expected rule, the actual decision and the network access observed by the endpoint.
A small set of approved regression tests is useful after future changes. We design it around meaningful boundaries rather than every possible packet. It should reveal when a new rule accidentally broadens access or disrupts an existing population. The customer can then review a change with evidence instead of relying solely on the absence of immediate complaints.
Provide a maintainable operating model
MCI supplies the access matrix, rule rationale, dependency map and test cases. We agree who can request a change, who approves the business permission and who implements it. This work supports new Cisco Access Manager deployments and reviews of inherited configurations. The deliverable is a policy that can be explained, tested and revised safely, with explicit limits rather than a promise that a product alone resolves every access-control problem.
Technical references
- Cisco Access Manager deployment guide — Cisco / Cisco Meraki
- Access Manager architecture and use cases — Cisco / Cisco Meraki
Talk to a specialist
What does your network need next?
Tell us what you are planning, changing or trying to improve. We will help define a practical next step and the engineering scope.
+44 203 196 6566Choose option 1
sales@proxar.co.ukUK-wide service.
Most of our engineers are based in Kent, with a focus on London, Sussex, Essex and Berkshire.
Existing customers should use their agreed support and escalation channels. This form is for service enquiries, not a monitored emergency ticket.
Tell us what you need.
A short outline is enough. Please do not include passwords or sensitive network details.
Thank you. Your enquiry has been submitted.
Please check your name, email and message, then try again.
Your form session expired. Please try again.
Please wait a minute before sending another enquiry.
We could not submit your enquiry. Please call or email us instead.