MAC Extended ACL/DHCP not blocked

[chrander]

Hello, I have created an Extended ACL with the primary goal to only allow a specific range of MAC addresses from a specific vendor. The rule functions as intended with 1 caveat. Any host that is connected on the port that is supposed to be denied, is able to handshake with our DHCP server and obtain an IP Address. That host is still blocked via the ACL. It would be ideal if DHCP was also blocked as well. 

mac access-list extended XXXXXX
permit any 0010.6a00.0000 0000.0011.1111
deny any any

interface GigabitEthernet1/7
description RSVD Radio MGMT
port-type eni
switchport access vlan 2
switchport mode access
power inline never
mac access-group XXXXXX in

Any help with this issue would be greatly appreciated! 

Cisco 4010 4S24P Ver 15.2(4r)EC

[MHM Cisco World]

check my below comment.

[chrander]

Our DHCP server needs to stay open for other devices to obtain DHCP on any other port of that vlan. We have a live device on this port with a build in hub, which cannot be disabled. So, I was hoping to limit risk of a host device being connected to this hub and obtaining an IP Address. The access list blocks any host from accessing the network very well, i would just like to block the DHCP somehow. I may try to apply a second Access list to this port just blocking dhcp.

[MHM Cisco World]

I will run lab find  way to deny DHCP request

[chrander · Accepted solution]

I seem to have found a solution. The below IP access list worked great. 

ip access-list extended Deny_DHCP
deny udp any any eq bootpc
deny udp any any eq bootps
permit ip any any

interface GigabitEthernet1/7
ip access-group Deny_DHCP in

[MHM Cisco World]

first thanks for sharing your config 
second I run lab and indeed the MAC acl can not deny the broadcast. 
I will read more about this issue and update you soon.