I have a ZyWall USG 200 firewall. A few days ago there was a SYN flooding attack on it causing 100% CPU load. After investigating it turns out this was attack from a single IP address and while the attack was going on the WAN port was downloading at 30Mbit/sec. The uplink on the firewall is 1Gbit and the attack didn't affect anything else on the network.
Blocking the attacker's IP address on the firewall didn't do anything.
I did a SYN flooding test myself and it shows that the firewall is very sensitive to SYN flooding. I have all content scanning services disabled because they cause high CPU load so I'm only using the firewall service.
I have contacted ZyXel and they responded that there was nothing I could do except wait for the attacker to give up. That is unacceptable because apparently anyone with a decent network connection is able to bring it down.
Is this normal and common issue in low-end firewalls? Is there anything I can do to prevent this?