Zone protection profiles (flood, reconnaissance, packet-based) and interface management profiles

A zone protection profile defends a whole zone against floods, scans and malformed packets. You create it under Network > Network Profiles > Zone Protection and attach it to the ingress zone, typically the Internet-facing zone, under Network > Zones. The firewall enforces it before security policy is even evaluated. That early placement is why it is cheap and effective: bad traffic is dropped before it consumes session resources. Zone protection is your first, broad layer of denial-of-service (DoS) defense.