Application Denial Policy to block rogue DHCP server response.

[ulss_5_ovestvic]

I'd like to create an ACL that block DHCP response frame from rogue DHCP server on wireless. I've tried to create a new "Application Denial Policy" like deny->port-->68 (all DHCP response are dst UDP port 68) and applied to WLAN but it seems to be don't work.
Anyone has used "Application Denial Policy" successfully?