> Source: [sk43317](https://support.checkpoint.com/results/sk/sk43317)

# sk43317 - IPS Inspection: Order of IPS and Security Gateway Operations

| Property | Value |
|----------|-------|
| Solution ID | sk43317 |
| Date Created | 2009-11-26 |
| Last Modified | 2015-08-16 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |

## Solution

Click Here to Show Entire FAQ

* In the IPS Inspection workflow, what is the order of IPS and Security Gateway (FireWall) inspections?  
  > In the majority of cases, IPS Inspection is done only for connections that have been accepted by the Security Gateway rule base. Meaning, first the connection is accepted by the rule base, only then does the IPS inspection takes place. The exception to this sequence is for protections that must be executed before the rule base is examined, for example: Port scanning and IP Fragmentation. These inspections take place before the rule base is examined because they are mandatory to safely assemble the IP and TCP Headers.

  <br />

* How does SecureXL/CoreXL affect the sequence of IPS inspections?  
  > When using CoreXL and SecureXL, the IPS inspection is accelerated by CoreXL and SecureXL and can leverage multiple CPU cores.  
  > Without CoreXL and SecureXL, IPS inspection takes place as part of the Security Gateway chain sequence.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content