03-04-2013 01:16 PM
SYN flood protection on zone protection allows the firewall to drop SYN packets when they exceed the activate rate. RED stands for random early drop and means that once the activate rate has been exceeded that SYN packets will be dropped at random to mitigate a possible SYN flood.
Since you are in TAP mode the value of zone protection is diminished as all traffic is dropped after processing in any case. When a packet is dropped by RED that packet is not forwarded to the dataplane for session setup and inspection, and no traffic log is created.
Please verify that the alarm, activate, and maximal rates are set for appropriate values for your environment. If under normal traffic loads you see bursts of new TCP sessions above 10,000/sec then you would want to increase these values to take that into account. The alarm rate is the rate that is required to trigger the threat log entry, while the activate rate is when packets begin being dropped.
