Connect. Secure. Manage.
Guest Wi-Fi Isolation Testing
Validate that Cisco or Meraki guest users cannot reach protected business resources, testing client isolation and the actual routing and firewall boundaries.
Devices supported
across the UK
Client locations
supported
Traffic handled
at peak time
Average
response time
Average response is not a resolution time or a contractual guarantee. Support scope and response commitments are agreed for each engagement.
Guest Wi-Fi isolation testing checks whether visitors can reach anything beyond the access they have been deliberately given. A separate SSID or VLAN is not sufficient evidence of isolation. MCI Network Services tests authorised Cisco and Meraki guest environments from the visitor's perspective, tracing the paths to business systems, infrastructure management and other guests. The result is a record of observed boundaries and specific corrections where those boundaries fail.
Coverage and capacity
Design Wi-Fi around the spaces, devices and traffic that depend on it.
Secure access
Align authentication, segmentation and guest access with the wider network.
Measured performance
Validate roaming, interference and user experience instead of relying on signal bars.
Define the test boundary before connecting
We agree the locations, SSIDs, address families and equipment included in the assessment. The customer identifies protected networks, permitted shared services and any third-party systems that require separate permission. Testing is carried out under written authorisation with an agreed schedule, traffic limits and a contact who can stop the work if business services are affected.
The intended policy becomes the test plan. Internet-only access has a different expected result from a visitor network that permits printing or access to a conference application. We record those exceptions explicitly so that a legitimate service is not reported as a failure and an undocumented shortcut is not accepted merely because it has always worked.
Standards & partnerships
Confidence in the team behind your network.
Cisco Partner
Cisco Meraki
Cyber Essentials
Cyber Essentials PlusMCI Network Services is operated by Proxar Ltd. Certifications apply to the certified legal entity and the scope of its certificates. View accreditation information
Check guest-to-business paths
We test representative connections from a guest device towards approved internal test targets. The assessment considers routed networks, management addresses, remote sites and cloud resources reachable through the organisation's wider network. A firewall rule covering the local office may not protect a prefix introduced through a later VPN connection.
Tests examine the actual return path as well as the outbound policy. A blocked connection can result from a missing route or an unavailable service rather than an effective security control. Where possible, we combine endpoint observations with firewall or routing evidence to establish why a connection was denied. The report distinguishes a verified boundary from an inconclusive test.
A useful starting point
Tell us what is happening.
A short description of the problem is enough for an initial discussion.
Test guest-to-guest communication separately
Client isolation is a distinct requirement. We check representative guests on the same access point and on different access points or network segments, according to the supported design. Different forwarding modes can change where client traffic is processed, so a successful local test should not be extrapolated across the whole estate.
The scope also considers discovery and broadcast-related behaviour where relevant. Visitors may be prevented from opening a direct connection but still discover services they should not see. Conversely, a meeting-space requirement may intentionally allow a defined presentation device. We document the intended discovery policy and test it without turning the assessment into unrestricted scanning of everyone present.
Different environments. The same care.
Built around the work
your network supports.
Finance, banking and the wider private sector. We start with the systems and people that depend on your connections.
Finance & banking
Market-data paths, routing and provider coordination on clients’ behalf.
Financial-market services ↗Offices & multi-site teams
Reliable access between people, workplaces and business applications.
Office network design ↗Data centres & cloud
Network boundaries, workload connections and operational ownership.
Data centre networks ↗Include IPv6 and alternative paths
An IPv4 rule set does not establish the treatment of IPv6. We check whether IPv6 is active, intentionally unavailable or incompletely configured, then test the resulting exposure within the authorised scope. The report does not describe a network as isolated solely because an IPv4 address list produced no response.
We also examine wired connections, secondary SSIDs and any portal bypass that could change the visitor's access. A guest who moves between access methods should not unexpectedly inherit a staff policy. Where device onboarding or sponsorship assigns permissions dynamically, we include representative authorisation changes and confirm the resulting network treatment.
Exercise admission and expiry states
The assessment covers the stages before portal approval, during an authorised session and after expiry or revocation. Pre-authentication allowances are reviewed for unintended access. A broad exception added for an external login provider can expose more destinations than the service owner intended.
We agree safe ways to test loss of an authentication dependency where necessary. The network may be configured to deny new sessions, retain existing sessions or apply restricted access. Those behaviours need to be documented and checked. An outage should not silently convert a controlled visitor network into an unrestricted corporate connection.
Report evidence that can guide remediation
Each finding identifies the test origin, intended restriction, observed result and affected control. We separate confirmed access from theoretical concerns and explain the operational impact in plain language. Evidence is restricted to what is needed; captured traffic and endpoint identifiers are handled as potentially sensitive material rather than attached indiscriminately to a report.
Remediation may involve routing, firewall policy, wireless client isolation or an identity rule. We describe the dependency and a suggested verification method, not simply instruct someone to add a blanket deny rule that could break the portal. Changes are separately approved, and a retest checks the corrected path and the legitimate service that must remain available.
Keep isolation valid after changes
A passed assessment describes the tested environment at a particular time. New VPN routes, cloud connections or wireless policy changes can alter the boundary. MCI can establish a repeatable set of checks for future changes alongside the initial assessment. For broader planning, Guest Wi-Fi Network Design explains how the visitor network should be structured before testing begins.
Technical references
- Wireless client isolation — Cisco / Cisco Meraki
- Guest and internal wireless networks — Cisco / Cisco Meraki
Talk to a specialist
Need a specialist view?
Tell us what is affected, what changed and what your team has already checked. A short outline is enough to start.
+44 203 196 6566Choose option 1
sales@proxar.co.ukUK-wide service.
Most of our engineers are based in Kent, with a focus on London, Sussex, Essex and Berkshire.
Existing customers should use their agreed support and escalation channels. This form is for service enquiries, not a monitored emergency ticket.
Tell us what you need.
A short outline is enough. Please do not include passwords or sensitive network details.
Thank you. Your enquiry has been submitted.
Please check your name, email and message, then try again.
Your form session expired. Please try again.
Please wait a minute before sending another enquiry.
We could not submit your enquiry. Please call or email us instead.