You can apply zone protection to a virtual wire interface,
but because virtual wire interfaces don’t perform routing, you can’t
apply
Packet-Based
Attack Protection to packets coming with a spoofed IP address,
nor can you suppress ICMP TTL Expired error packets or ICMP Frag
Needed packets.