https://live.paloaltonetworks.com/t5/next-generation-firewall/triggering-of-packet-based-protection-under-zone-protection/m-p/1265760#M7168 <P>In the PA documentation, it says Zone protection is applicable to new connections that does not have any existing session. To mitigate flood protection that will works definitely.&nbsp; However under Zone protection profile we have packet based attack protection which deals packet based attacks&nbsp; which uses certain option in layer3 and 4 of a packet.&nbsp;<BR />malfunction / corrupted Packets&nbsp; that&nbsp; may intended for attack may arrive during middle of connection which may match to the existing session, for example initial packet of a new connection may arrive correctly and after few packets attacker may uses those options in the layer3 and layer 4 of packet to do some attacks. So in such cases how PA FW mitigates the such packet based attacks ? Because zone protection profile is applicable to new connections, but in this scenario packet matching to an existing session is bad packet intended for attack.&nbsp; Documentation clearly&nbsp; says connection matching to existing session bypasses the Zone protection and DOS protections.&nbsp;<BR />I have put a prompt in Chatgpt and Gemini they replied that packet based attack protections applies even for the existing session also. Please help to understand this&nbsp;</P> Wed, 07 Oct 2026 06:29:37 GMT Vnithkumar 2026-10-07T06:29:37Z https://live.paloaltonetworks.com/t5/next-generation-firewall/triggering-of-packet-based-protection-under-zone-protection/m-p/1265760#M7168 <P>In the PA documentation, it says Zone protection is applicable to new connections that does not have any existing session. To mitigate flood protection that will works definitely.&nbsp; However under Zone protection profile we have packet based attack protection which deals packet based attacks&nbsp; which uses certain option in layer3 and 4 of a packet.&nbsp;<BR />malfunction / corrupted Packets&nbsp; that&nbsp; may intended for attack may arrive during middle of connection which may match to the existing session, for example initial packet of a new connection may arrive correctly and after few packets attacker may uses those options in the layer3 and layer 4 of packet to do some attacks. So in such cases how PA FW mitigates the such packet based attacks ? Because zone protection profile is applicable to new connections, but in this scenario packet matching to an existing session is bad packet intended for attack.&nbsp; Documentation clearly&nbsp; says connection matching to existing session bypasses the Zone protection and DOS protections.&nbsp;<BR />I have put a prompt in Chatgpt and Gemini they replied that packet based attack protections applies even for the existing session also. Please help to understand this&nbsp;</P> Wed, 07 Oct 2026 06:29:37 GMT https://live.paloaltonetworks.com/t5/next-generation-firewall/triggering-of-packet-based-protection-under-zone-protection/m-p/1265760#M7168 Vnithkumar 2026-10-07T06:29:37Z