You can apply zone protection to a virtual wire interface,
but because virtual wire interfaces don’t perform routing, you can’t
apply
Packet Based Attack Protection to
packets coming with a spoofed IP address, nor can you suppress ICMP
TTL Expired error packets or ICMP Frag Needed packets.