A Zone Protection profile applied to a zone offers protection against most common floods, reconnaissance attacks, other packet-based attacks, and the use of non-IP protocols. It is designed to provide broad-based protection at the ingress zone (the zone where traffic enters the firewall) and is not designed to protect a specific end host or traffic going to a particular destination zone. You can attach one zone protection profile to a zone.

To augment zone protection capabilities on the firewall, configure a DoS Protection policy (Policies > DoS Protection) to match on a specific zone, interface, IP address, or user.