A network device comprising: a first network interface for communicatively coupling to a data network; a second network interface for communicatively coupling to a data plane configured to host a plurality of virtual network functions, VNFs, each VNF comprising one or more resource instances in a cascaded node chain (412, 414, 416), the cascaded node chain comprising a head node configured to receive external traffic, zero or more middle nodes and a tail node, wherein each node comprises a flow table comprising flow entries; and a resource controller engine configured to: provide a backup downlink between a first node on the data plane and a second node on the data plane, wherein the second node does not immediately follow the first node in the cascaded node chain; receive a network flow via the first network interface; send the network flow to the data plane via the second network interface; receive the network flow back from the data plane; determine that the network flow does not match a flow entry in the cascaded node chain; provision a flow entry on a resource instance to match the network flow; determine that all resource instances on the cascaded node chain have exhausted their flow capacities; spawn a new resource instance in the cascaded node chain; and designate the new resource instance as a tail node. a first network interface for communicatively coupling to a data network; a second network interface for communicatively coupling to a data plane configured to host a plurality of virtual network functions, VNFs, each VNF comprising one or more resource instances in a cascaded node chain (412, 414, 416), the cascaded node chain comprising a head node configured to receive external traffic, zero or more middle nodes and a tail node, wherein each node comprises a flow table comprising flow entries; and a resource controller engine configured to: provide a backup downlink between a first node on the data plane and a second node on the data plane, wherein the second node does not immediately follow the first node in the cascaded node chain; receive a network flow via the first network interface; send the network flow to the data plane via the second network interface; receive the network flow back from the data plane; determine that the network flow does not match a flow entry in the cascaded node chain; provision a flow entry on a resource instance to match the network flow; determine that all resource instances on the cascaded node chain have exhausted their flow capacities; spawn a new resource instance in the cascaded node chain; and designate the new resource instance as a tail node. provide a backup downlink between a first node on the data plane and a second node on the data plane, wherein the second node does not immediately follow the first node in the cascaded node chain; receive a network flow via the first network interface; send the network flow to the data plane via the second network interface; receive the network flow back from the data plane; determine that the network flow does not match a flow entry in the cascaded node chain; provision a flow entry on a resource instance to match the network flow; determine that all resource instances on the cascaded node chain have exhausted their flow capacities; spawn a new resource instance in the cascaded node chain; and designate the new resource instance as a tail node.