topic Re: Do we require DDoS protection ( Zone Protection ) if we have only two TCP services open to the internet. in Next-Generation Firewall Discussions

Do we require DDoS protection ( Zone Protection ) if we have only two TCP services open to the internet.

Kandarp_Desai — Wed, 02 Aug 2023 13:55:33 GMT

We only have IPsec tunnels on the firewall.

Re: Do we require DDoS protection ( Zone Protection ) if we have only two TCP services open to the internet.

akuzhuppilly — Thu, 03 Aug 2023 05:23:35 GMT

Hello @Kandarp_Desai

The zone/DoS protections are there to save your firewall resources from traffic flooding.

If you think that there won't be any flooding in your network, then you do not need to enable them.

Re: Do we require DDoS protection ( Zone Protection ) if we have only two TCP services open to the internet.

ozheng — Thu, 03 Aug 2023 09:47:18 GMT

Actually it is a bit more than only protecting about flooding attacks.

In the ZP, you can set some protection against port scanning (reconnaissance attacks), you can drop some improper packets (that may sometimes affect applications, but that's rare).

Anyway, in today's Internet, ZP protection is a must-have (I think it is also a best practice to enable it).
The configuration of it ... it is up to everyone's requirement I guess.

Olivier