Connect. Secure. Manage.
Cisco Wired Authentication
Introduce wired 802.1X on Cisco switches with staged enforcement, device exceptions and recovery arrangements that protect essential access.
Devices supported
across the UK
Client locations
supported
Traffic handled
at peak time
Average
response time
Average response is not a resolution time or a contractual guarantee. Support scope and response commitments are agreed for each engagement.
Cisco wired authentication controls what a device may do when it is plugged into an office network. It is particularly useful where desk ports, meeting rooms and shared spaces make physical access easy. MCI Network Services designs and deploys supported wired network-access controls around the real endpoint population, with staged enforcement and clear recovery procedures. The purpose is to replace an assumption of trust with an access decision that can be explained.
Defined trust
Make access boundaries explicit rather than relying on an assumed internal network.
Controlled access
Connect identity, policy and network enforcement to the services people actually use.
Evidence for change
Test the intended security outcome and retain useful operational records.
Understand what is connected to each port
A port inventory needs more than switch names and VLAN numbers. We identify workstations, phones, printers, meeting-room systems and specialist equipment, including connections that carry more than one device. An IP phone with a computer behind it may require different handling from a single desktop or an access point.
We also identify ports that are not ordinary endpoint connections. Switch uplinks, management paths and infrastructure services should not inherit a desktop authentication template without review. Misclassifying an uplink can disconnect many users at once. The design records interface roles and exceptions before policy is applied to a range of ports.
Standards & partnerships
Confidence in the team behind your network.
Cisco Partner
Cisco Meraki
Cyber Essentials
Cyber Essentials PlusMCI Network Services is operated by Proxar Ltd. Certifications apply to the certified legal entity and the scope of its certificates. View accreditation information
Choose an appropriate authentication method
For capable managed endpoints, 802.1X can establish identity through an agreed supplicant and authentication service. Certificate-based methods require endpoint configuration and certificate ownership as well as switch settings. We work with the endpoint team to confirm how devices behave before user login, after a password change and when they have been away from the network for an extended period.
Devices without a suitable supplicant may need a restricted alternative, such as MAC Authentication Bypass on supported platforms. A MAC address can be copied, so this is not treated as equivalent to strong certificate authentication. We pair the exception with a limited service scope, inventory ownership and a plan for removing it when the device changes or becomes capable of a stronger method.
A useful starting point
Not sure where to start?
Bring the requirement. We will help you define the engineering work.
Decide what successful authentication permits
Authentication does not have to mean unrestricted corporate access. We define the network permissions for the device's role and verify that the selected Cisco switches can enforce the intended result. Dynamic VLAN assignment, downloadable access controls or group-based segmentation are evaluated against the actual hardware and software combination.
The surrounding network must be ready for those decisions. Required VLANs, gateways, DHCP scopes and firewall rules need to exist before an endpoint is assigned to them. A correct identity response followed by a failed DHCP exchange is still a failed service. Our test plan follows the client beyond the authentication message into the applications it is meant to use.
Different environments. The same care.
Built around the work
your network supports.
Finance, banking and the wider private sector. We start with the systems and people that depend on your connections.
Finance & banking
Market-data paths, routing and provider coordination on clients’ behalf.
Financial-market services ↗Offices & multi-site teams
Reliable access between people, workplaces and business applications.
Office network design ↗Data centres & cloud
Network boundaries, workload connections and operational ownership.
Data centre networks ↗Handle timing and multi-device behaviour
Wired access has practical timing requirements. A phone must register, a workstation may need pre-login services, and a dock may reconnect several interfaces when a laptop wakes. We test representative combinations and check the supported host mode rather than assuming that one port policy fits every desk.
Reauthentication, link changes and authorisation updates are considered separately. A policy change should not unexpectedly place an established device in an unusable state. Where a change-of-authorisation mechanism is used, we confirm the network path and device behaviour. We record the difference between a newly connected endpoint and one already carrying a session.
Move from observation to enforcement
A staged rollout provides evidence of unknown endpoints and incomplete client preparation. Where the selected platform supports a suitable monitoring or low-impact approach, we use it to understand the estate before applying restrictive settings. Observation is a transition stage with a defined objective, not a permanent claim that access is being enforced.
The enforcement plan groups ports by risk and readiness. We agree a maintenance window, recovery access and the decision that triggers rollback. Support staff receive clear guidance for identifying whether a failure concerns the cable, supplicant, credential, policy response or subsequent network service. That prevents every disconnected device becoming an indiscriminate request to disable authentication.
Plan for unavailable authentication services
The customer must decide what happens when the authentication dependency cannot be reached. Restricted fallback, denial and continuation of established access have different security and availability implications. We document the supported behaviour and test it under an agreed fault scenario rather than relying on a default whose effect nobody has observed.
Restoration matters as much as failure. Devices placed into a recovery policy need a predictable route back to normal authorisation. We verify that the recovery does not leave a privileged exception behind or trigger a disruptive estate-wide reconnect at an unsuitable time.
Deliver a supportable access standard
The handover includes interface templates, endpoint exceptions, acceptance results and ownership of the identity service. MCI can integrate wired access with Cisco ISE or assess another supported architecture where appropriate. Our proposal identifies the implementation boundaries and the ongoing tasks needed to keep the port policy aligned with the equipment actually being connected.
Technical references
- Cisco ISE overview — Cisco / Cisco Meraki
- Cisco ISE deployment — Cisco / Cisco Meraki
Talk to a specialist
What does your network need next?
Tell us what you are planning, changing or trying to improve. We will help define a practical next step and the engineering scope.
+44 203 196 6566Choose option 1
sales@proxar.co.ukUK-wide service.
Most of our engineers are based in Kent, with a focus on London, Sussex, Essex and Berkshire.
Existing customers should use their agreed support and escalation channels. This form is for service enquiries, not a monitored emergency ticket.
Tell us what you need.
A short outline is enough. Please do not include passwords or sensitive network details.
Thank you. Your enquiry has been submitted.
Please check your name, email and message, then try again.
Your form session expired. Please try again.
Please wait a minute before sending another enquiry.
We could not submit your enquiry. Please call or email us instead.