Connect. Secure. Manage.
Cisco TLS Inspection Design
Assess Cisco TLS inspection requirements, certificate distribution, application exceptions and privacy boundaries before enabling decryption.
Devices supported
across the UK
Client locations
supported
Traffic handled
at peak time
Average
response time
Average response is not a resolution time or a contractual guarantee. Support scope and response commitments are agreed for each engagement.
Cisco TLS inspection design sets where selected encrypted traffic may be decrypted for security checks. We assess supported options alongside certificate trust, app compatibility, privacy and device capacity. The design states its purpose, exclusions and owners. Tests are agreed before use, since blanket inspection can disrupt services and expose information that should remain outside scope.
Defined trust
Make access boundaries explicit rather than relying on an assumed internal network.
Controlled access
Connect identity, policy and network enforcement to the services people actually use.
Evidence for change
Test the intended security outcome and retain useful operational records.
Establish why inspection is needed
We find the threat or visibility need the customer is trying to address. Outbound user browsing and inbound traffic to an owned app are different use cases, with different certificate and key duties. The design should explain which flows are in scope and what inspection result is expected from them.
Decryption is not always the right answer for every service. Some apps use certificate pinning, mutual authentication or protocols whose behaviour makes interception unsuitable. We assess those constraints and consider alternative controls where necessary. The aim is a defensible security decision, not the highest possible percentage of traffic reported as decrypted.
Standards & partnerships
Confidence in the team behind your network.
Cisco Partner
Cisco Meraki
Cyber Essentials
Cyber Essentials PlusMCI Network Services is operated by Proxar Ltd. Certifications apply to the certified legal entity and the scope of its certificates. View accreditation information
Involve privacy and application owners
Inspection may expose information that was previously encrypted between endpoints. The customer's legal, privacy and security owners must assess the purpose, applicable needs and transparency arrangements. MCI can document the technical data flow and control options. But the network design does not invent a lawful basis or substitute for that assessment.
We identify categories and apps requiring exclusion or special handling, together with the reason and approving owner. Those decisions are translated into a maintainable policy. A vague instruction to avoid sensitive traffic is not enough. The rollout needs a supported way to identify the relevant flows and a process for reviewing changes.
A useful starting point
Not sure where to start?
Bring the requirement. We will help you define the engineering work.
Design certificate trust carefully
For supported outbound interception, managed endpoints need the appropriate trust setup. We coordinate distribution with the endpoint team and protect the associated signing material. Users should not be asked to ignore browser warnings as a routine part of using business systems.
Inbound inspection has a different ownership model involving the service's certificates and private keys. We establish who may supply and manage that material, how renewals are handled and which systems depend on it. Private keys are not included in ordinary change documents or emailed casually between teams. The design records the secure handling process and recovery duties.
Different environments. The same care.
Built around the work
your network supports.
Finance, banking and the wider private sector. We start with the systems and people that depend on your connections.
Finance & banking
Market-data paths, routing and provider coordination on clients’ behalf.
Financial-market services ↗Offices & multi-site teams
Reliable access between people, workplaces and business applications.
Office network design ↗Data centres & cloud
Network boundaries, workload connections and operational ownership.
Data centre networks ↗Check the actual Cisco capability
We check the firewall platform, software, licences and supported protocol behaviour for the proposed inspection mode. Capabilities can differ by release and traffic type. A product description should not be treated as evidence that every encrypted app or transport can be inspected with the same policy.
Capacity is assessed with the intended features enabled. Decryption, inspection and logging can change resource demand significantly compared with basic forwarding. We consider connection rates, app mix and the workload after a device failure where resilience is required. The result identifies measured evidence and assumptions rather than promising nominal throughput for an untested combination.
Build a small, representative pilot
The pilot includes ordinary browsing and the business apps most likely to reveal compatibility issues. We test certificate trust, authentication, file transfers and app updates, not only the loading of a public home page. Where mobile or unmanaged devices are in scope, their trust and support model is assessed separately.
We also test the intended exclusions and denied conditions. A policy can appear successful because traffic silently bypasses inspection. The acceptance record therefore checks which action was applied and why, while limiting retained packet or content data to what the approved investigation requires.
Define failure and exception behaviour
The customer must decide what should happen when inspection cannot be completed or a required dependency fails. Permitting traffic, blocking it or applying another control has different consequences. We document the supported behaviour and test representative conditions rather than leaving it to an unexplained default.
Exceptions are narrow, owned and reviewable. A temporary bypass added during a production incident should not remain indefinitely without reassessment. The support procedure explains how to identify an inspection-related fault, collect safe evidence and get approval for a change without weakening unrelated traffic protection.
We set out how an app owner requests an exclusion and what evidence is needed to justify it. The decision records its scope, security consequence and review date. A narrowly approved compatibility exception should not be expanded to an entire category simply because that is quicker to configure during support.
Handover the design as an operating service
MCI provides the scope, certificate duties, policy rationale, pilot evidence and maintenance needs. Renewals, client trust changes and app updates are included in the operating model. The work can accompany Cisco intrusion prevention tuning or a firewall rollout, but decryption remains a separately approved control with clear privacy and service boundaries, not an automatic claim of improved compliance.
Technical references
- Cisco Secure Firewall 10.0 feature documentation — Cisco / Cisco Meraki
- Data protection and monitoring workers — Information Commissioner's Office
Talk to a specialist
What does your network need next?
Tell us what you are planning, changing or trying to improve. We will help define a practical next step and the engineering scope.
+44 203 196 6566Choose option 1
sales@proxar.co.ukUK-wide service.
Most of our engineers are based in Kent, with a focus on London, Sussex, Essex and Berkshire.
Existing customers should use their agreed support and escalation channels. This form is for service enquiries, not a monitored emergency ticket.
Tell us what you need.
A short outline is enough. Please do not include passwords or sensitive network details.
Thank you. Your enquiry has been submitted.
Please check your name, email and message, then try again.
Your form session expired. Please try again.
Please wait a minute before sending another enquiry.
We could not submit your enquiry. Please call or email us instead.