The culture at one of our main branch offices is very open and loose. Historically when people have needed more ports in their space they could just grab a switch from someone with access to our equipment room and this was OK with management.
This is not OK to me. I have about 30 small desktop class switches of various flavors which connect up through patch panels to primary access level gear like Cisco 3750's. I want to centralize distribution of small switches and prevent undocumented sprawl, but need advice on the best way to approach this.
I considered going into each desktop switch, shutting down all not-in-use ports and then restricting the in-use ports to a single MAC. The problem is not all of the desktop flavors support this as readily as port-security on cisco enterprise devices. I considered doing the port-security upstream at the 3750's but overall I wonder how larger offices handle this kind of problem and if there's an easier way to track if a new switch has been plugged in somewhere without proper authorization?
Thanks in advance!