There's definitely not a single way to provide end-to-end encryption as you've asked, but packet sniffing as you wish to protect against can really only performed at few places in a typical corporate environment. 1 - physical network taps between devices 2 - span/monitor ports on devices 3 - attacks that force traffic to go where it is not intended.
For #1 - as @Jeremy Stretch mentioned IEEE 802.1ae/MACsec can be used hop-by-hop between devices, so a tap will only see encrypted data. While the data is "clear" within the switches (See #2), this is often needed to apply the desired QoS, security and other controls before forwarding to the next hop. However, it's fairly new and requires compatible endpoints and switches.
For #2 - Your physical and network security policy should limit access to the network devices to prevent an attacker from gaining access. Using a VPN client on each desktop and concentrators near the servers can provide another level of protection from third parties in the middle. Port-forwarding/tunneling over SSH between endpoints is another option, as well as IPSec everywhere like @fredpbaker mentioned gets you a bit closer but it's tough to implement.
For #3 - most enterprise network devices have tools to mitigate MITM/ARP attacks, rouge DHCP servers, spanning tree attacks and others meant to redirect traffic to where an attacker can listen in.
In the end you can use one, or all of these techniques to better protect data in-flight. Only a combination of these and a robust security policy to protect data-at-rest, the endpoints, physical security, and lots of time and money can really meet the goal you outlined!