Thoughts on network segmentation for managing devices/infrastructure.

What's the consensus on using network segmentation and firewalls to control management access to such devices.

EG:

• Firewall/network equipment management interfaces.
• Domain controllers (RDP, RPC or WMI etc etc)
• Radius/TACACS services

The attempt is to control access (Using identity based access via firewall eventually move to ZTNA) on such devices that manage other services within the domain/LAN but... issues arise when there is only one NIC which is used for access as well as standard service traffic.

Is there a clean way to accomplish this? Really easy to do on networking devices, but servers or apps depending on what they are adding a second interface and routing only specific traffic is a toss up.

Anyone have any words of wisdom or is this a you'll need to build as you go rather than overhaul.

Thanks in advance.