During a security posture review of the core network, an analyst discovers that administrators manage routers and switches via Telnet and SSH sessions that traverse the same VLANs carrying production user and server traffic. The analyst is asked to recommend a network hardening improvement that best reduces the risk of an attacker who compromises a user endpoint from intercepting or reaching device management interfaces. Which recommendation should the analyst make?