+100 here. Issue devices with hardware certs, and allow only cert-bearing devices on the network, period. Now you have precise and revocable control over what's

+100 here. Issue devices with hardware certs, and allow only cert-bearing devices on the network, period. Now you have precise and revocable control over what's on the network. Well, as long as you ensure SSH doesn't mess it up. ;) Combine that with security keys, and you're in a decent spot.