When an encrypted packet is decrypted, where does this happen?

In Check Point's packet processing architecture, decryption of encrypted VPN traffic occurs at the Security Policy stage. The gateway must decrypt the packet before the Security Policy blades can inspect plaintext content, so decryption is integrated into Security Policy processing - not handled by a separate dedicated chain before or after policy evaluation.

The Inbound chain handles early interface-level packet reception steps, but VPN decryption is not performed there - it is handled further into the processing pipeline at the Security Policy layer.

The Outbound chain processes traffic as it leaves the gateway; incoming encrypted packets are not decrypted at this stage.

Check Point actively supports decryption of VPN and SSL/TLS encrypted traffic, so the claim that decryption is unsupported is factually incorrect.