Do we require DDoS protection ( Zone Protection ) if we have only two TCP services open to the internet.

[Kandarp_Desai]

We only have IPsec tunnels on the firewall. 

[akuzhuppilly]

Hello @Kandarp_Desai 

The zone/DoS protections are there to save your firewall resources from traffic flooding.

If you think that there won't be any flooding in your network, then you do not need to enable them.

[ozheng · Accepted solution]

Actually it is a bit more than only protecting about flooding attacks.

In the ZP, you can set some protection against port scanning (reconnaissance attacks), you can drop some improper packets (that may sometimes affect applications, but that's rare).

Anyway, in today's Internet, ZP protection is a must-have (I think it is also a best practice to enable it).
The configuration of it ... it is up to everyone's requirement I guess.

Olivier