The hypervisor or VM provisioning system can set it up. With something like certs you can just drop a <1mb iso on the host for each VM The cert only needs to p

The hypervisor or VM provisioning system can set it up. With something like certs you can just drop a <1mb iso on the host for each VM The cert only needs to prove the VM is who it says it is >ensure that you and only you can do this on the network You've already solved that with your VM provisioning system If you're talking about physical/hardware, you can take more liberties with the network since it can be isolated during the initial provisioning step