In my network I run dhcpd3 set up to assign IP addresses only to specific MAC addresses. It works wonderfully, I even integrated it with bind9 to automatically create direct and reverse DNS hostnames with a custom TLD and all.
But one thing I haven't figured out yet: if the user sets up a static IP on his machine he will have access to the network. Using iptables to filter IP addresses not in the range assigned by dhcpd3 also doesn't help much, because if the user with the IP address 192.168.0.20 is not on the office, that IP address would be still on the allowed list. And when he plugs his computer, we would have a lot of trouble with duplicated addresses and such.
A solution where dhcpd3 (or some other DHCP server) runs an external script that calls iptables to unblock the address would be very nice, but I were unable to find a DHCP server that does that.
I considered using 802.1X with RADIUS, but I have some printers and IP phones on the network that doesn't support it, so I would need to tell the switches that some ports wouldn't use 802.1X. That opens a hole where they could add small 8-port switches to the network and plug their machines there. Also, the IP phones have an embedded 2-port switch.
I know there's something called RADA where you allow specific MAC addresses to circunvent the RADIUS authentication, but my switches doesn't support it unfortunely.
I'm really out of ideas on this one. Maybe there's a very simple and elegant solution but I really couldn't find out by myself.