You can SPAN internal traffic to an IDS device currently. Or, if internal network throughput isn’t an issue, you can force east-west traffic through an IPS with DPI enabled instead.

That’s historically how east-west would be mediated within an enterprise environment for devices incapable of being secured with agents.

1. Snort on perimeter inbound and outbound.
2. ntopng on perimeter.
3. Heavy VLAN segmentation. Like with like.
4. Inter-VLAN ACLs on core switch. This is a stateless firewall. Some VLANs with certain device types have inbound and outbound. Trusted devices only have inbound.
5. SPAN to Security Onion for all internal traffic.
6. SNMPv3 monitoring on all devices.
7. MAC Sticky on all camera ports because the cabling extends outside of the physical structure of the house. I am going to implement Dot1X at some point.
8. VRFs for sensitive infrastructure to prevent outbound routing completely.
9. A VRF for devices to be forced through an external VPN (Mullvad). Used for devices that do not support a VPN agent.
10. No antivirus. All antivirus is a botnet.
11. All server infrastructure is Devuan using OpenRC instead of systemd.
12. Gaming PC is Artix.
13. DNS blackhole.
14. Public DNS is a Swiss no-logging provider which I use DoT to send my queries to.
15. LibreWolf or Brave Browser on everything.
16. Only hole into the network is a 4096 bit encrypted Wireguard instance operating in a container using an uncommon port. I wrote a custom script that can reach into the container and pull from the API in order to show active sessions, GeoIP, browser fingerprints, length of time the socket has been open, etc.
17. I use geofencing for inbound connections to the Wireguard instance. I only allow my immediate area cellular ISPs IANA address spaces to touch my network. Same goes for the geographic area surrounding my parents house.
18. Unattended updates using custom scripting for my servers, including rebuilding the Wireguard container every single night, updating the server, and I also fire Nessus at it every night. If in the morning there is a CVE of note on that server, the NAT rule allowing traffic to the VPN is disabled at the perimeter until a sufficient patch is released.
19. I run STIGs on everything, within reason and where infrastructure allows, in my suite.
20. LibreSSL over OpenSSL.

Anything that has internet access like your IoT can be C&C utilizing stateful connections. An outbound socket is built, and reflected traffic can come back in. Your IoT devices especially should not be exposed to the internet. They can’t even have an antivirus agent installed on them.

everyone in here has a gucci poweredge or proliant but when it comes to networking they’ll buy a potmetal switch made by a child slave in bangladesh and call it a day if it has 2.5g connections