Is it possible to DDoS/DoS a public IP which has only outbound traffic and ipsec tunnel. No DNAT configured and ping disabled.

[addawes]

Rather not play with fire and enable DoS protection and Zone protection on all outside interfaces/zones.

[LAYER_8]

In theory this is still possible. Most DDoS attacks Palo sees now are reflection-based amplification attacks... UDP, not ICMP. (Which sounds like these are allowed in your network).  

Mirai botnet... reflected and amplified NTP on IoT devices with outbound rules. Is it harder with only outbound rules and hiding behind NAT? Yes. Impossible? No. Unless you know for certain all current inside devices are clean, and you know where they are 365 days a year, it's still possible. Slim, hence defense in depth, but possible.

Consider also DDoS lives on loads of NAS, routers, home security kits so in some cases reflection/amplification will still come down that IPSec tunnel depending on what terminates it.

+1 on the above for DoS/Zone protection profiles on zones. 

[TomYoung]

Hi @Kandarp_Desai ,

Traffic from the Internet to the public IP (same zone) is allowed by the default intrazone-default rule.  You could create an intrazone drop rule to block the traffic, and no DoS should be possible.  Remember to create an allow rule for your IPsec tunnel first.

Thanks,

Tom