I need to control who is able to connect to ACNS (based on ip), preferably per stream or program.

1) The only thing i found is to put an ACL on the interface do deny some IP addresses.

a) Is there another method ?

b) Can you 'deploy' the ACL method via the content device manager or does it need to be applied locally ?

2) Is it possible to color the streaming packets (unicast and multicast) with a certain DSCP value, per program, via the CDM (centrally) ? Right now, the only solution i have found is via a service-policy map on the physical switch port.