Restrict certain MAC addresses to access internet

[kazarsm]

i want to restrict certain users of the network (WAN) from getting ip address (To restrict internet connection not WAN) from the DHCP server (which is windows server 2008 r2). I need help achieving this with MAC ACLs if possible (other solutions are welcomed). i'm running a Cisco catalyst 2970 switch. 

[Georg Pauwen]

Hello,

check if the 2970 supports port ACLs (I think it does):

ip access-list extended DENY_UDP_67_68
 deny udp any any eq 67
 deny udp any any eq 68
 permit ip any any

interface FastEthernet0/0
 ip access-group DENY_UDP_67_68 in

[kazarsm]

Okay. I'll try this and give a feedback. Thx

[Philip D'Ath]

Why not configure your DHCP server to only give out statically allocated (reserved) addresses?

[kazarsm]

This is the easiest solution for now. But can't the users just assign an IP address for themselves to avoid the dhcp server (assuming that they know the address range defined) ?