Connect. Secure. Manage.
Cisco FlexConnect Design
Plan Cisco FlexConnect for branch wireless, documenting local switching, authentication dependencies and what happens when WAN connectivity is lost.
Devices supported
across the UK
Client locations
supported
Traffic handled
at peak time
Average
response time
Average response is not a resolution time or a contractual guarantee. Support scope and response commitments are agreed for each engagement.
Cisco FlexConnect design separates the way a branch wireless service is controlled from the way selected client traffic is forwarded. It can support useful local forwarding arrangements on compatible Cisco access points, but the result depends on authentication, VLANs and the behaviour expected when controller connectivity is lost. MCI Network Services designs FlexConnect around the branch’s actual applications and dependencies, rather than treating it as a universal answer to unreliable WAN links.
Coverage and capacity
Design Wi-Fi around the spaces, devices and traffic that depend on it.
Secure access
Align authentication, segmentation and guest access with the wider network.
Measured performance
Validate roaming, interference and user experience instead of relying on signal bars.
Map the branch application paths
We begin with the services used at each location. A branch may access cloud applications directly, reach internal systems across a WAN and use local printers or operational equipment. Those flows should not automatically share the same forwarding decision. We identify where traffic must be inspected, where addresses are assigned and which network team owns the gateway and firewall policies.
The site assessment also records its users, devices and working hours. A small sales office and a distribution site may use the same access-point family but have very different continuity requirements. We agree what must remain available during a circuit or controller outage and which functions can reasonably stop. That creates a testable design objective instead of an undefined request for the branch to keep working under every condition.
Standards & partnerships
Confidence in the team behind your network.
Cisco Partner
Cisco Meraki
Cyber Essentials
Cyber Essentials PlusMCI Network Services is operated by Proxar Ltd. Certifications apply to the certified legal entity and the scope of its certificates. View accreditation information
Choose forwarding and authentication independently
Local switching and central switching affect where client data leaves the wireless system. Authentication has its own dependencies and supported options. We review both choices for each service, including the identity servers, certificates and client behaviour involved. Local forwarding does not automatically mean that a new user can authenticate when the remote identity service is unavailable.
The design distinguishes established clients from fresh connections and reauthentication events. We assess the supported standalone behaviour of the exact access-point and controller software combination. Where an application requires continued operation during a WAN outage, its addressing, name resolution and authorisation dependencies are tested too. A local data path is useful only when the services needed to use that path remain reachable.
A useful starting point
Not sure where to start?
Bring the requirement. We will help you define the engineering work.
Align access-point ports and VLAN mappings
A locally switched service needs the appropriate wired configuration at the branch. We review access-point switch ports, permitted VLANs, tagging expectations and gateway placement. The controller policy and local switching configuration must agree about the network into which a client is placed. An access point can remain joined to the controller while a mismatch prevents only one client group from reaching its applications.
Consistent site templates help, but genuine local differences need explicit treatment. Addressing, guest breakout and legacy equipment can vary across branches. We document those exceptions and test them instead of assuming that a configuration copied from the first site is correct everywhere. Switch-port protection and management access are reviewed alongside wireless policy so that the deployment does not solve forwarding by unnecessarily weakening the access layer.
Different environments. The same care.
Built around the work
your network supports.
Finance, banking and the wider private sector. We start with the systems and people that depend on your connections.
Finance & banking
Market-data paths, routing and provider coordination on clients’ behalf.
Financial-market services ↗Offices & multi-site teams
Reliable access between people, workplaces and business applications.
Office network design ↗Data centres & cloud
Network boundaries, workload connections and operational ownership.
Data centre networks ↗Structure the controller configuration clearly
On Catalyst 9800, the relevant policy and site relationships need to represent the chosen branch arrangement. We define profile and tag names that make their purpose apparent, then verify how they are assigned to access points. A default or inherited assignment should not determine a branch’s service accidentally. The design record links the intended site behaviour to the actual configuration objects.
We also consider how engineers will diagnose a fault remotely. The handover explains which checks belong on the controller, access point, branch switch or identity service. That avoids an incident being passed between teams merely because each can see its own component as healthy. Our Cisco wireless policy tags work can help rationalise a configuration that has become difficult to understand through successive rollouts.
Test disconnected and recovery conditions
Acceptance includes normal connection tests and the agreed loss-of-connectivity scenarios. We check existing sessions, new authentication, address renewal and representative application access while the relevant dependency is unavailable. The test plan states which clients and security methods are included. Results from one laptop do not establish the behaviour of every scanner, handset or certificate-based endpoint at the branch.
Recovery matters just as much. We observe what happens when controller or WAN connectivity returns, whether clients reconnect as expected and whether monitoring clears correctly. Tests that would disrupt production need a suitable window and a rollback plan. Where a failure cannot be simulated safely, the limitation is recorded rather than being counted as a successful resilience test.
Deliver a branch standard that can be maintained
The final deliverables include the forwarding decision for each wireless service, authentication dependencies, VLAN mappings and a site-specific acceptance record. Changes to a branch firewall or identity service should trigger a review of the corresponding wireless assumptions. We also identify which operational team can approve exceptions and how temporary workarounds will be removed.
MCI delivers Cisco and Meraki network services for organisations with sites across the UK. For FlexConnect, provide a branch topology, the current controller arrangement and the applications that must continue during an outage. We can then assess whether FlexConnect fits the requirement, compare alternatives where appropriate and produce a design that remains understandable when the next site or service is added.
Technical references
- FlexConnect branch deployment guide — Cisco / Cisco Meraki
- Catalyst 9800 configuration model — Cisco / Cisco Meraki
Talk to a specialist
What does your network need next?
Tell us what you are planning, changing or trying to improve. We will help define a practical next step and the engineering scope.
+44 203 196 6566Choose option 1
sales@proxar.co.ukUK-wide service.
Most of our engineers are based in Kent, with a focus on London, Sussex, Essex and Berkshire.
Existing customers should use their agreed support and escalation channels. This form is for service enquiries, not a monitored emergency ticket.
Tell us what you need.
A short outline is enough. Please do not include passwords or sensitive network details.
Thank you. Your enquiry has been submitted.
Please check your name, email and message, then try again.
Your form session expired. Please try again.
Please wait a minute before sending another enquiry.
We could not submit your enquiry. Please call or email us instead.