Connect. Secure. Manage.
Network Macrosegmentation
Separate major business and technical zones using Cisco routing, VLANs and firewalls, documenting permitted flows between those zones.
Devices supported
across the UK
Client locations
supported
Traffic handled
at peak time
Average
response time
Average response is not a resolution time or a contractual guarantee. Support scope and response commitments are agreed for each engagement.
Network macrosegmentation creates clear boundaries between the major parts of an organisation's network. It is often the most practical starting point when staff devices, servers, management systems and building equipment have accumulated on an overly open infrastructure. MCI Network Services designs Cisco and Meraki macrosegmentation around the services that need to communicate, using routing and enforcement controls that make those boundaries meaningful rather than merely giving each area a different name.
Defined trust
Make access boundaries explicit rather than relying on an assumed internal network.
Controlled access
Connect identity, policy and network enforcement to the services people actually use.
Evidence for change
Test the intended security outcome and retain useful operational records.
Identify the large trust zones
We begin by grouping systems according to their function, ownership and access requirements. A typical assessment might distinguish user access, production applications, guest connectivity, administration and operational equipment. The actual zones are chosen with the customer; a generic office diagram should not determine the treatment of specialist systems or financial-market connections.
A zone is useful when its members share a sufficiently similar trust relationship. Combining everything labelled 'internal' can preserve the very problem segmentation is meant to address. Equally, dividing the network into many small zones without an operating model can create complexity without a corresponding improvement in control.
Standards & partnerships
Confidence in the team behind your network.
Cisco Partner
Cisco Meraki
Cyber Essentials
Cyber Essentials PlusMCI Network Services is operated by Proxar Ltd. Certifications apply to the certified legal entity and the scope of its certificates. View accreditation information
Map the paths between zones
The next task is to identify how traffic moves today. We examine default gateways, routed links, firewalls, wireless forwarding and remote-access paths. Historical connections and temporary links deserve attention because they can bypass the boundary shown in the latest diagram.
We also look for services with interfaces in more than one zone. A dual-connected server or management appliance can create an unintended bridge between areas that appear isolated at the network layer. The assessment records these dependencies so the proposed architecture covers the real forwarding paths, not only the infrastructure under one team's direct control.
A useful starting point
Not sure where to start?
Bring the requirement. We will help you define the engineering work.
Choose a supported boundary design
VLANs can separate Layer 2 traffic, while VRFs and other routing arrangements can maintain distinct forwarding contexts on suitable platforms. Firewalls and access controls determine which routed connections are permitted. We choose the combination according to the equipment, throughput, operational skills and required security decisions.
The design explains where enforcement happens and what it depends on. A VRF without a controlled connection to shared services may break useful applications; unrestricted route leaking may remove the intended separation. Our Cisco VRF-Lite segmentation service addresses routing-context detail where that is part of the selected architecture, without presenting routing separation as a substitute for all security policy.
Different environments. The same care.
Built around the work
your network supports.
Finance, banking and the wider private sector. We start with the systems and people that depend on your connections.
Finance & banking
Market-data paths, routing and provider coordination on clients’ behalf.
Financial-market services ↗Offices & multi-site teams
Reliable access between people, workplaces and business applications.
Office network design ↗Data centres & cloud
Network boundaries, workload connections and operational ownership.
Data centre networks ↗Build the inter-zone service matrix
For each required connection, we record the source zone, destination, service, purpose and owner. Infrastructure dependencies such as DNS, identity, time synchronisation and backups are included alongside the main application flows. This gives the implementation team a defined policy rather than a series of urgent requests to permit everything temporarily.
The matrix should also identify administration paths. Routine user access to an application is different from privileged access to its management interface. We consider dedicated administrative entry points and monitoring requirements so that protecting a production zone does not depend on allowing broad management access from every workstation network.
Plan an achievable migration sequence
Macrosegmentation can change addressing, gateways, firewall policy and application paths. We identify which changes can be separated and which must occur together. A staged plan might move a defined device group first, validate its dependencies and then extend the same boundary to other systems once the assumptions have been tested.
A rollback plan must account for the actual change. Returning a VLAN gateway is not enough if DHCP, DNS or application allowlists have already moved. We record the restoration sequence and the last safe decision point, with named people available to validate the business services affected by the cutover.
Test the boundary under normal and degraded conditions
Acceptance includes successful approved workflows and representative attempts to cross the boundary where access should be refused. Tests should cover alternative gateways and remote-access paths where they exist. We also examine the effect of losing an enforcement device or upstream link, because a resilience mechanism must not silently bypass the security requirement.
Evidence is recorded in terms of the connection tested and the control observed. A rule appearing in a configuration is not sufficient proof that traffic passes through it. Where a particular test cannot be performed safely, its limitation is documented rather than described as a verified result.
Keep broad zones from becoming permanently broad exceptions
Over time, new applications and urgent incidents can introduce inter-zone rules that are wider than necessary. We recommend an exception register with ownership, business justification and review points. Unused zones and obsolete routes should also be revisited so that the architecture remains understandable as the estate changes.
MCI can assess an existing flat network, prepare a macrosegmentation design or implement an agreed transition across UK sites. The outcome is a set of enforceable boundaries, documented permitted flows and a support process that explains how future changes are approved. More detailed workload or identity controls can then be introduced where the business case requires them, rather than treating maximum complexity as the starting objective.
Technical references
- Network segmentation overview — Cisco / Cisco Meraki
- Zero-trust network and cloud design — Cisco / Cisco Meraki
Talk to a specialist
What does your network need next?
Tell us what you are planning, changing or trying to improve. We will help define a practical next step and the engineering scope.
+44 203 196 6566Choose option 1
sales@proxar.co.ukUK-wide service.
Most of our engineers are based in Kent, with a focus on London, Sussex, Essex and Berkshire.
Existing customers should use their agreed support and escalation channels. This form is for service enquiries, not a monitored emergency ticket.
Tell us what you need.
A short outline is enough. Please do not include passwords or sensitive network details.
Thank you. Your enquiry has been submitted.
Please check your name, email and message, then try again.
Your form session expired. Please try again.
Please wait a minute before sending another enquiry.
We could not submit your enquiry. Please call or email us instead.