A method of deep packet inspection in a Software Defined Networking environment, the method being performed by a network switch and comprising the steps of: receiving a set configuration command from a controller, wherein the set configuration command sets an operational mode for deep packet inspection, DPI, wherein the operational mode for deep packet inspection is one of an observation mode and an enforce mode, when a particular packet has been sent to a firewall for deep packet inspection, in the observation mode the network switch does not wait for a response from the firewall, and in the enforce mode the network switch will not output or drop the particular packet until a response is received from the firewall; receiving an address of the firewall from the controller; establishing communications with the firewall; receiving a get configuration request from the firewall; sending a configuration reply to the firewall, wherein the configuration reply includes the operational mode for deep packet inspection; receiving a first packet of a first packet flow; determining whether information contained in the first packet of the first packet flow does not match any entry in a flow table; forwarding at least a portion of the first packet of the first packet flow to the controller, and then forwarding at least a portion of the first packet of the first packet flow to the firewall for deep packet inspection if the controller determines DPI scan is configured on the first packet flow; sending the first packet of the first packet flow through a port toward a destination without looking for a message from the firewall when the operational mode of the network switch is the observation mode; receiving a second packet of the first packet flow; determining that information contained in the second packet of the first packet flow matches an entry in the flow table and DPI scan is configured on the first packet flow; when a number of bytes forwarded to the firewall for the first packet flow is less than a pre-determined number of bytes, forwarding at least a portion of the second packet of the first packet flow to the firewall for deep packet inspection; and sending the second packet of the first packet flow through a port to an address identified in the flow table without looking for a message from the firewall when the operational mode of the network switch is in the observation mode. receiving a set configuration command from a controller, wherein the set configuration command sets an operational mode for deep packet inspection, DPI, wherein the operational mode for deep packet inspection is one of an observation mode and an enforce mode, when a particular packet has been sent to a firewall for deep packet inspection, in the observation mode the network switch does not wait for a response from the firewall, and in the enforce mode the network switch will not output or drop the particular packet until a response is received from the firewall; receiving an address of the firewall from the controller; establishing communications with the firewall; receiving a get configuration request from the firewall; sending a configuration reply to the firewall, wherein the configuration reply includes the operational mode for deep packet inspection; receiving a first packet of a first packet flow; determining whether information contained in the first packet of the first packet flow does not match any entry in a flow table; forwarding at least a portion of the first packet of the first packet flow to the controller, and then forwarding at least a portion of the first packet of the first packet flow to the firewall for deep packet inspection if the controller determines DPI scan is configured on the first packet flow; sending the first packet of the first packet flow through a port toward a destination without looking for a message from the firewall when the operational mode of the network switch is the observation mode; receiving a second packet of the first packet flow; determining that information contained in the second packet of the first packet flow matches an entry in the flow table and DPI scan is configured on the first packet flow; when a number of bytes forwarded to the firewall for the first packet flow is less than a pre-determined number of bytes, forwarding at least a portion of the second packet of the first packet flow to the firewall for deep packet inspection; and sending the second packet of the first packet flow through a port to an address identified in the flow table without looking for a message from the firewall when the operational mode of the network switch is in the observation mode.