In an office environment, if I wanted to block youtube using a Cisco ISR router, I would set up the following with NBAR:
class-map match-all YOUTUBE match protocol http host "*youtube.com*" ! policy-map DROP_YOUTUBE class YOUTUBE drop ! interface FastEthernet0/0 description TO INTERNET service-policy output DROP_YOUTUBE
This is a global configuration, but how does one tweak it so that it only applies to certain workstations (via IP or MAC addresses)?