Connect. Secure. Manage.
Cisco Always-On VPN Design
Assess supported always-on Cisco VPN behaviour, balancing endpoint connectivity, trusted networks, support access and recovery requirements.
Devices supported
across the UK
Client locations
supported
Traffic handled
at peak time
Average
response time
Average response is not a resolution time or a contractual guarantee. Support scope and response commitments are agreed for each engagement.
Cisco always-on VPN design plans how managed devices keep the required access as users move between networks. We assess supported Secure Client and gateway options alongside trusted-network checks and support access. The policy must also allow a workable recovery route. Keeping a tunnel active is useful only if users and support teams can still do their jobs.
Defined trust
Make access boundaries explicit rather than relying on an assumed internal network.
Controlled access
Connect identity, policy and network enforcement to the services people actually use.
Evidence for change
Test the intended security outcome and retain useful operational records.
Define what always-on means for your users
The business need should state which traffic must be protected, when the connection is expected to establish and what users may do while the service is unavailable. A laptop used by travelling staff has different network access constraints from a fixed remote workstation. We identify those patterns before selecting client settings.
Always-on behaviour is also distinct from pre-logon access and a management tunnel. These functions can have different purposes, authentication needs and platform support. We clarify which capability the customer needs rather than treating all unattended or persistent connections as the same feature with interchangeable setup.
Standards & partnerships
Confidence in the team behind your network.
Cisco Partner
Cisco Meraki
Cyber Essentials
Cyber Essentials PlusMCI Network Services is operated by Proxar Ltd. Certifications apply to the certified legal entity and the scope of its certificates. View accreditation information
Verify the supported endpoint and gateway combination
We review operating systems, client releases, gateway software and relevant entitlements. The design must reflect the features supported by that exact combination, including certificate and profile needs. A setting available in a profile editor is not evidence that every managed endpoint will behave identically.
Existing endpoint security products and other network clients are considered as well. They may affect DNS, firewall behaviour or connection establishment. We identify ownership of those components and arrange a representative pilot, avoiding a rollout based only on a clean test machine that lacks the customer's normal management and security controls.
A useful starting point
Not sure where to start?
Bring the requirement. We will help you define the engineering work.
Design trusted-network detection carefully
A managed device may need different behaviour on a trusted corporate network and on an external connection. We assess the supported signals used to distinguish those situations and the risk of misclassification. The result should not depend on a weak assumption that a familiar network name or address range always proves the device is in a trusted location.
Changes to DNS, certificates or network infrastructure can affect detection. We document those dependencies and test movement between setups, including recovery after the client initially makes the wrong decision. The customer needs a clear explanation of which conditions trigger connection or disconnection and who maintains those conditions over time.
Different environments. The same care.
Built around the work
your network supports.
Finance, banking and the wider private sector. We start with the systems and people that depend on your connections.
Finance & banking
Market-data paths, routing and provider coordination on clients’ behalf.
Financial-market services ↗Offices & multi-site teams
Reliable access between people, workplaces and business applications.
Office network design ↗Data centres & cloud
Network boundaries, workload connections and operational ownership.
Data centre networks ↗Decide what happens when the tunnel cannot form
An always-on policy needs a clear failure model. Blocking ordinary traffic may support the security aim. But the device still needs the network services required to authenticate, resolve the gateway and establish the connection. Captive portals and restricted external networks can introduce extra complications that must be tested in the supported client workflow.
The plan sets out approved exceptions and recovery access without opening an unrestricted bypass. We also consider what happens when a certificate expires, the identity service is unavailable or the gateway cannot be reached. A policy that protects traffic during normal operation but prevents authorised repair during an outage is not operationally complete.
Validate identity and certificate lifecycle
Persistent network access can involve different authentication timing from an ordinary user-initiated VPN. We examine how the proposed identity method behaves during startup, reconnection and session renewal, and how any required user interaction fits the design. MFA and unattended connections should not be assumed compatible in every arrangement without verification.
Gateway trust and endpoint certificates are checked as lifecycle dependencies. Renewal, revocation and replacement must work for devices that are rarely in the office. We avoid advising users to dismiss certificate errors or disable protection to regain access; recovery should follow an approved process supported by the actual platform.
Test state changes, not only a successful connection
The pilot covers startup, sleep, resume, network changes and the relevant sign-in states. We test representative business apps and examine the effect of brief network access loss, failed authentication and restoration. User-visible behaviour is recorded so support staff can distinguish an expected restriction from a fault.
Tests also check which traffic remains outside the tunnel, if any, and whether that matches the customer's policy. A connected VPN icon does not prove that every app flow uses the intended path. Routing and DNS evidence are compared with the observed app behaviour.
Prepare rollout and ongoing support
Profiles and client settings should be distributed through a controlled endpoint-management process, with a tested reversal method. Support staff need instructions that work when the endpoint cannot reach its usual management service. We agree escalation and exceptional access before broad enforcement rather than inventing those steps during the first travel-related incident.
MCI can assess always-on suitability within a wider secure remote access design or help correct a current rollout that causes avoidable disruption. The deliverable identifies supported behaviour, failure decisions and practical tests. It does not promise uninterrupted access from every external network or treat persistent connection as a substitute for app and endpoint security.
Technical references
- Cisco Secure Client VPN configuration — Cisco / Cisco Meraki
- Cisco Secure Client profile editor — Cisco / Cisco Meraki
Talk to a specialist
What does your network need next?
Tell us what you are planning, changing or trying to improve. We will help define a practical next step and the engineering scope.
+44 203 196 6566Choose option 1
sales@proxar.co.ukUK-wide service.
Most of our engineers are based in Kent, with a focus on London, Sussex, Essex and Berkshire.
Existing customers should use their agreed support and escalation channels. This form is for service enquiries, not a monitored emergency ticket.
Tell us what you need.
A short outline is enough. Please do not include passwords or sensitive network details.
Thank you. Your enquiry has been submitted.
Please check your name, email and message, then try again.
Your form session expired. Please try again.
Please wait a minute before sending another enquiry.
We could not submit your enquiry. Please call or email us instead.