[Conan]

OSI 7 layer means application layer, so advanced DDOS firewalls protect against port scanning too
https://hostsailor.com/ddos-protection-and-mitigation/

Port scanning is VERY HARD TO MITIGATE. It's hard to tell if it's a legitimate user or a bot. It just detects multiple attempts which is bruteforcing.

I don't really like the term DDoS firewall. It's just basically a firewall with strong packet filtering function.

Firewalls may protect against DDoS but it doesn't i clude Layer 7 protection MOST OF THE TIME. The resources needed for filtering Layer 7 connections is just too damn high.

EDIT:
Just some more additional info.
Most of the Firewalls that protect against Layer 7 attacks just works on http/https or some other very widely used and attacked protocols.

Please don't rely on those for port scanning protection. They don't protect you from it.