Anomalous Behaviour and Dual Boot machines

[Ricardo T Duarte]

Hi there,

I would like to use the Anomalous Behaviour with automatic enforcement, but would like to allow changes from Windows to Linux and Linux to Windows. 

From the documentation it seems that this change will trigger "anomalous behaviour".

Is there a way to circumvent this issue (ex: only use main classes like Workstation to Printer, and allow changes inside the same class)?

Thanks

[anthonylofreso]

Hmm, I am also curious about this. I've seen very little documentation regarding Anomalous Behavior and the ability to write good policy.

[howon · Accepted solution]

It will depend on whether the Linux will send DHCP Vendor Class ID. AFAIK, most Linux doesn't send Vendor Class ID so the endpoint will be profiled as WIndows and not trigger the ABD.