Connect. Secure. Manage.
Cisco ISE Deployment
Design and deploy Cisco ISE around network access requirements, identity sources, node placement, certificates and an agreed acceptance test.
Devices supported
across the UK
Client locations
supported
Traffic handled
at peak time
Average
response time
Average response is not a resolution time or a contractual guarantee. Support scope and response commitments are agreed for each engagement.
Cisco ISE deployment starts with the users, devices and access rules the business needs. We plan the supported platform and coordinate work across identity, endpoint and network teams. Tests cover daily use, faults and maintenance. The aim is a working access service with clear support roles, beyond simply installing the ISE servers.
Defined trust
Make access boundaries explicit rather than relying on an assumed internal network.
Controlled access
Connect identity, policy and network enforcement to the services people actually use.
Evidence for change
Test the intended security outcome and retain useful operational records.
Assemble the prerequisites before installation
We establish the target release, supported compute platform, licences and expected scale. The preparation also covers addressing, DNS, time synchronisation, certificates, admin access and backup destinations. Missing foundations often appear later as confusing authentication or replication failures. So we check them before the first production network device is pointed at ISE.
The customer identifies owners for identity directories, certificate issuance and endpoint setup. Those teams may need to approve changes that the network team cannot make. We record the required permissions and delivery dates alongside the technical plan. A rollout window should not begin with an assumption that someone can get domain or certificate authority access on demand.
Standards & partnerships
Confidence in the team behind your network.
Cisco Partner
Cisco Meraki
Cyber Essentials
Cyber Essentials PlusMCI Network Services is operated by Proxar Ltd. Certifications apply to the certified legal entity and the scope of its certificates. View accreditation information
Translate access requirements into policy
We build a policy matrix showing the connecting population, authentication method and resulting permission. Staff laptops, guests, phones and non-user devices are considered separately. Unknown endpoints need a clear treatment, including the resources required for any approved onboarding or remediation process.
The matrix is then mapped to ISE policy sets and the capabilities of the enforcement devices. We check how the chosen switches or controllers handle returned VLANs, access lists, security groups and session changes. A laboratory policy can look correct while relying on a feature missing from part of the production estate. Those gaps belong in the design decision, not in a post-cutover fault list.
A useful starting point
Not sure where to start?
Bring the requirement. We will help you define the engineering work.
Place nodes around operational requirements
We consider administration, policy-service and monitoring duties, together with the available failure domains. Capacity includes expected session demand and the load remaining after a planned or unplanned node outage. Deployment choices are checked against Cisco's guidance for the actual release and platform rather than inferred from virtual-machine CPU counts alone.
Network reachability between nodes and their dependencies is documented. We review firewalls, directory paths and access-device source addresses so that the intended traffic is allowed without opening unnecessary management exposure. Remote sites need a defined response when their connection to the policy service is lost; local resilience and restricted fallback are separate design decisions.
Different environments. The same care.
Built around the work
your network supports.
Finance, banking and the wider private sector. We start with the systems and people that depend on your connections.
Finance & banking
Market-data paths, routing and provider coordination on clients’ behalf.
Financial-market services ↗Offices & multi-site teams
Reliable access between people, workplaces and business applications.
Office network design ↗Data centres & cloud
Network boundaries, workload connections and operational ownership.
Data centre networks ↗Build a pilot that represents the estate
The pilot includes different operating systems, certificate states, user groups and connection types. We deliberately include devices that are likely to expose exceptions, such as a phone with a workstation behind it or a printer without an enterprise supplicant. The aim is to discover operational work before broad enforcement, not to get a favourable demonstration from a single prepared laptop.
For each test, we record both the ISE decision and the resulting network access. A successful RADIUS response does not prove that the user received the correct route or restriction. We also test rejected credentials, expired certificates and users in the wrong group. Negative tests are part of acceptance, not an optional security exercise after rollout.
Roll out in controlled groups
The change sequence identifies which sites or interfaces move first, how current sessions are handled and when the team pauses to assess the result. We preserve recovery access that does not depend on the policy being changed. Emergency exceptions are tightly scoped and recorded so that a temporary workaround does not become the normal access model.
A site is not complete merely because no one has reported a problem. We compare the intended population with observed sessions, investigate unknown devices and confirm that support staff can recognise common failures. Lessons from early groups are incorporated before the next rollout stage rather than repeated across the entire estate.
Validate maintenance and recovery
Acceptance covers loss of an agreed policy-service node, dependency failures where safe, backup handling and the effect of restoring normal service. We distinguish network-device failover from ISE administration or monitoring availability. The customer receives a clear account of what was tested and what remains a design assumption.
The recovery documentation includes certificate expiry ownership, directory reconnection considerations and the evidence needed for escalation. We do not promise that every authentication session survives every failure. The useful commitment is a defined, tested response for the scenarios agreed in the project scope.
Hand over more than configuration
MCI provides the approved policy matrix, node and dependency diagrams, records of the settings, test results and an exception register. Operational duties explain who handles user enrolment, device onboarding, policy changes and platform maintenance. Ongoing support is separately scoped through our Cisco ISE services. So the customer knows which activities continue after rollout and which remain with its internal teams.
Technical references
- Cisco ISE deployment — Cisco / Cisco Meraki
- Cisco ISE performance and scalability — Cisco / Cisco Meraki
Talk to a specialist
What does your network need next?
Tell us what you are planning, changing or trying to improve. We will help define a practical next step and the engineering scope.
+44 203 196 6566Choose option 1
sales@proxar.co.ukUK-wide service.
Most of our engineers are based in Kent, with a focus on London, Sussex, Essex and Berkshire.
Existing customers should use their agreed support and escalation channels. This form is for service enquiries, not a monitored emergency ticket.
Tell us what you need.
A short outline is enough. Please do not include passwords or sensitive network details.
Thank you. Your enquiry has been submitted.
Please check your name, email and message, then try again.
Your form session expired. Please try again.
Please wait a minute before sending another enquiry.
We could not submit your enquiry. Please call or email us instead.