What are some good ways to handle untrusted devices on a wired network? Here are a couple of examples of what I'm thinking about:
One the company owners brings his laptop in regularly and plugs in to the network.
User brings in a laptop or othe device and plugs in for whatever reason, but not to be intentialy malicious.
Laptop comes in from field that may have viruses but needs to be connected to get updates, etc.
All of our normal devices use static IPs. One idea I had was to turn off DHCP on our work subnet and then create 2nd subnet with DHCP setup to server IPs on it. Basically, we would end up with two subnets running on the same physical network. The idea would be that any untrusted device would get an IP from DHCP and thus put be put on the untrusted subnet.