A method for offloading the application of security policies to balance computing resources within a network fabric, comprising: establishing, by a first switch, a network tunnel between the first switch and a second switch in a network fabric, wherein the second switch enforces security policies for a policy group including a first Endpoint Group, EPG, that are physically connected to the first switch; in response to receiving a communication from the first EPG at the first switch intended for a destination, the communication including a source IP address of the first switch and a Virtual Private Network, VPN, Routing and Forwarding identifier, VRF ID, of the first EPG: modifying, by the first switch, the source IP address with a port offset associated with a port of the first switch to which the first EPG is connected, modifying, by the first switch, the VRF ID with a group offset associated with an identity of the policy group, and transmitting, by the first switch, the communication via the network tunnel from the first switch to the second switch; and in response to receiving the communication over the network tunnel at the second switch from the first switch: identifying, by the second switch, the security policies for the policy group based on the group offset, and in response to determining, by the second switch, that the communication is permitted by the security policies, transmitting, by the second switch, the communication to the destination. establishing, by a first switch, a network tunnel between the first switch and a second switch in a network fabric, wherein the second switch enforces security policies for a policy group including a first Endpoint Group, EPG, that are physically connected to the first switch; in response to receiving a communication from the first EPG at the first switch intended for a destination, the communication including a source IP address of the first switch and a Virtual Private Network, VPN, Routing and Forwarding identifier, VRF ID, of the first EPG: modifying, by the first switch, the source IP address with a port offset associated with a port of the first switch to which the first EPG is connected, modifying, by the first switch, the VRF ID with a group offset associated with an identity of the policy group, and transmitting, by the first switch, the communication via the network tunnel from the first switch to the second switch; and modifying, by the first switch, the source IP address with a port offset associated with a port of the first switch to which the first EPG is connected, modifying, by the first switch, the VRF ID with a group offset associated with an identity of the policy group, and transmitting, by the first switch, the communication via the network tunnel from the first switch to the second switch; and in response to receiving the communication over the network tunnel at the second switch from the first switch: identifying, by the second switch, the security policies for the policy group based on the group offset, and in response to determining, by the second switch, that the communication is permitted by the security policies, transmitting, by the second switch, the communication to the destination. identifying, by the second switch, the security policies for the policy group based on the group offset, and in response to determining, by the second switch, that the communication is permitted by the security policies, transmitting, by the second switch, the communication to the destination.