A system for implementing policies in a software defined network, SDN, of a virtual computing environment, the system comprising: one or more processors; and a memory in communication with the one or more processors, the memory having computer-readable instructions stored thereupon that, when executed by the one or more processors, cause the system to perform operations comprising: receiving, at an ingress port from a first of the network switches (1710, 1730), a data packet addressed to an endpoint in a virtual network of the virtual computing environment, the virtual computing environment comprising two SDN appliances communicatively coupled to two network switches, the SDN appliances configured to disaggregate enforcement of policies of the SDN from hosts of the virtual computing environment; mapping a policy associated with the endpoint based on the virtual network associated with the data packet; applying the policy to the data packet; wherein the policy is dynamically adjustable based on the endpoint; in response to determining that a corresponding egress port on the first network switch has failed; forwarding, via a second egress port on the second network switch, the data packet to the endpoint; and maintaining flow states for the data packet when the data packet is sent via the second egress port of the second network switch. one or more processors; and a memory in communication with the one or more processors, the memory having computer-readable instructions stored thereupon that, when executed by the one or more processors, cause the system to perform operations comprising: receiving, at an ingress port from a first of the network switches (1710, 1730), a data packet addressed to an endpoint in a virtual network of the virtual computing environment, the virtual computing environment comprising two SDN appliances communicatively coupled to two network switches, the SDN appliances configured to disaggregate enforcement of policies of the SDN from hosts of the virtual computing environment; mapping a policy associated with the endpoint based on the virtual network associated with the data packet; applying the policy to the data packet; wherein the policy is dynamically adjustable based on the endpoint; in response to determining that a corresponding egress port on the first network switch has failed; forwarding, via a second egress port on the second network switch, the data packet to the endpoint; and maintaining flow states for the data packet when the data packet is sent via the second egress port of the second network switch. receiving, at an ingress port from a first of the network switches (1710, 1730), a data packet addressed to an endpoint in a virtual network of the virtual computing environment, the virtual computing environment comprising two SDN appliances communicatively coupled to two network switches, the SDN appliances configured to disaggregate enforcement of policies of the SDN from hosts of the virtual computing environment; mapping a policy associated with the endpoint based on the virtual network associated with the data packet; applying the policy to the data packet; wherein the policy is dynamically adjustable based on the endpoint; in response to determining that a corresponding egress port on the first network switch has failed; forwarding, via a second egress port on the second network switch, the data packet to the endpoint; and maintaining flow states for the data packet when the data packet is sent via the second egress port of the second network switch.