Best placement of Suricata IPS?

Ok, so you suggest sys-net → sys-firewall → sys-ips → sys-vpn → qube?

In this tread: ANN: sys-ips it is mentioned that sys-firewall is not needed when running sys-ips.

Do you not agree with that?