A method, comprising: determining whether a packet received at a network device corresponds to a new flow or an existing flow that has an entry in a flow table programmed with a switching decision for the existing flow; if it is determined that the packet received at a network device corresponds to the existing flow, switching the packet in a fast path in accordance with the switching decision in the entry in the flow table; if it is determined that the packet received at a network device corresponds to a new flow: punting the received packet to a slow path where further processing takes place to arrive at a switching decision to determine an action to be performed with respect to the packet; determining whether space is available in the flow table of the network device to add a new entry identifying the new flow and comprising an indication of the determined action, wherein the determining whether space is available is accomplished with reference to reservation information specified in a port profile associated with the new flow, the port profile containing network policy information for a virtual machine, VM, with which the new flow is associated and configuration information for configuring a virtual port for the VM, the configuration information including the reservation information; subsequent to a determination that space is available, adding the new entry to the flow table; subsequent to a determination that space is not available, evaluating whether an existing entry in the flow table can be aged out based on the reservation information specified in the associated port profile; subsequent to an evaluation that an existing entry can be aged out, aging out the existing entry and adding the new entry to the flow table; and subsequent to an evaluation that an existing entry cannot be aged out, switching the received packet based on the action determined in the slow path and refraining from adding the entry for the new flow in the flow table. determining whether a packet received at a network device corresponds to a new flow or an existing flow that has an entry in a flow table programmed with a switching decision for the existing flow; if it is determined that the packet received at a network device corresponds to the existing flow, switching the packet in a fast path in accordance with the switching decision in the entry in the flow table; if it is determined that the packet received at a network device corresponds to a new flow: punting the received packet to a slow path where further processing takes place to arrive at a switching decision to determine an action to be performed with respect to the packet; determining whether space is available in the flow table of the network device to add a new entry identifying the new flow and comprising an indication of the determined action, wherein the determining whether space is available is accomplished with reference to reservation information specified in a port profile associated with the new flow, the port profile containing network policy information for a virtual machine, VM, with which the new flow is associated and configuration information for configuring a virtual port for the VM, the configuration information including the reservation information; subsequent to a determination that space is available, adding the new entry to the flow table; subsequent to a determination that space is not available, evaluating whether an existing entry in the flow table can be aged out based on the reservation information specified in the associated port profile; subsequent to an evaluation that an existing entry can be aged out, aging out the existing entry and adding the new entry to the flow table; and subsequent to an evaluation that an existing entry cannot be aged out, switching the received packet based on the action determined in the slow path and refraining from adding the entry for the new flow in the flow table. punting the received packet to a slow path where further processing takes place to arrive at a switching decision to determine an action to be performed with respect to the packet; determining whether space is available in the flow table of the network device to add a new entry identifying the new flow and comprising an indication of the determined action, wherein the determining whether space is available is accomplished with reference to reservation information specified in a port profile associated with the new flow, the port profile containing network policy information for a virtual machine, VM, with which the new flow is associated and configuration information for configuring a virtual port for the VM, the configuration information including the reservation information; subsequent to a determination that space is available, adding the new entry to the flow table; subsequent to a determination that space is not available, evaluating whether an existing entry in the flow table can be aged out based on the reservation information specified in the associated port profile; subsequent to an evaluation that an existing entry can be aged out, aging out the existing entry and adding the new entry to the flow table; and subsequent to an evaluation that an existing entry cannot be aged out, switching the received packet based on the action determined in the slow path and refraining from adding the entry for the new flow in the flow table.