Control network access using MAC/ARP ACL

[wags2272]

I want to deny access to my network from "rogue" systems using a MAC address based ACL. I want to allow my systems which are from the same vendor to be plugged into any port, but deny all others.

Here is what I know and don't know.

Know: MAC address for the systems are the same except for last 4 characters.

Don't know: How to filter outgoing traffic to block ARP requests from rogue systems.

Don't know: Whether the filter would need to be applied to each port, or to a vlan?

Thanks for the help.

JT