The Application Control blade requires Deep Packet Inspection (DPI) to identify applications based on their traffic signatures. This level of inspection cannot be offloaded to the SecureXL acceleration hardware/software layer. Therefore, the connection must be fully processed by the Firewall Kernel, which is known as the Firewall Path or, more commonly, the Slow Path. Any traffic requiring inspection by a Threat Prevention blade or any blade that uses DPI will be handled by the Slow Path, even if SecureXL is enabled.

B. The Medium Path is for connections that require some kernel processing (like NAT) but not full DPI, so it's not used for Application Control.

C. The Fast Path (or Accelerated Path) is used when a connection is fully offloaded to SecureXL, which is not possible with Application Control inspection.

D. The Accelerated Path is synonymous with the Fast Path and is bypassed when DPI blades like Application Control are active on the connection.

- Check Point. (2022). R81.20 Security Gateway Architecture Overview. Page 13, "Packet Flow". States that the first packet is processed by the Firewall kernel (Slow Path) and if inspection is needed by blades like Application Control, subsequent packets also use this path.

- Check Point Support Center. (2023). sk32578: SecureXL mechanism. This document details the packet paths, clarifying that connections requiring "deep inspection" are passed to the Firewall kernel (Slow Path).

- Check Point Support Center. (2023). sk98722: Best Practices - Security Gateway Performance. Section "SecureXL". Lists features that disable acceleration, including Application Control & URL Filtering.