A method comprising: communicating, by a proxy, with one or more virtual switches, wherein the one or more virtual switches conform to an OpenFlow specification, wherein the OpenFlow specification includes a first set of one or more rules defining how network traffic originating from or being transmitted to a virtual machine is managed at the one or more virtual switches; communicating, by the proxy, with one or more controllers using an OpenFlow protocol, wherein the proxy comprises a rule repository storing a second set of one or more rules defining how network traffic originating from or being transmitted to the virtual machine is managed at the one or more virtual switches; receiving, by a virtual switch of the one or more virtual switches, a packet from the virtual machine, wherein if the packet does not match a rule of the first set of one or more rules, then forwarding the packet to the proxy; receiving, by the proxy, the packet from the virtual switch of the one or more virtual switches; and determining, by the proxy, whether a rule of the second set of one or more rules at the rule repository matches the packet, wherein if a rule of the second set of one or more rules matches the packet, then transmitting the rule matching the packet to the virtual switch from the proxy to cause updating of the first set of one or more rules at the virtual switch with the rule transmitted from the proxy, and if a rule of the second set of one or more rules does not match the packet, then querying, by the proxy, a controller of the one or more controllers for a rule matching the packet, receiving, by the proxy, the rule matching the packet from the controller, updating, by the proxy, the second set of one or more rules with the rule matching the packet, and transmitting the rule matching the packet to the virtual switch from the proxy to cause updating of the first set of one or more rules at the virtual switch with the rule transmitted from the proxy. communicating, by a proxy, with one or more virtual switches, wherein the one or more virtual switches conform to an OpenFlow specification, wherein the OpenFlow specification includes a first set of one or more rules defining how network traffic originating from or being transmitted to a virtual machine is managed at the one or more virtual switches; communicating, by the proxy, with one or more controllers using an OpenFlow protocol, wherein the proxy comprises a rule repository storing a second set of one or more rules defining how network traffic originating from or being transmitted to the virtual machine is managed at the one or more virtual switches; receiving, by a virtual switch of the one or more virtual switches, a packet from the virtual machine, wherein if the packet does not match a rule of the first set of one or more rules, then forwarding the packet to the proxy; receiving, by the proxy, the packet from the virtual switch of the one or more virtual switches; and determining, by the proxy, whether a rule of the second set of one or more rules at the rule repository matches the packet, wherein if a rule of the second set of one or more rules matches the packet, then transmitting the rule matching the packet to the virtual switch from the proxy to cause updating of the first set of one or more rules at the virtual switch with the rule transmitted from the proxy, and if a rule of the second set of one or more rules does not match the packet, then querying, by the proxy, a controller of the one or more controllers for a rule matching the packet, receiving, by the proxy, the rule matching the packet from the controller, updating, by the proxy, the second set of one or more rules with the rule matching the packet, and transmitting the rule matching the packet to the virtual switch from the proxy to cause updating of the first set of one or more rules at the virtual switch with the rule transmitted from the proxy. wherein if a rule of the second set of one or more rules matches the packet, then transmitting the rule matching the packet to the virtual switch from the proxy to cause updating of the first set of one or more rules at the virtual switch with the rule transmitted from the proxy, and if a rule of the second set of one or more rules does not match the packet, then querying, by the proxy, a controller of the one or more controllers for a rule matching the packet, receiving, by the proxy, the rule matching the packet from the controller, updating, by the proxy, the second set of one or more rules with the rule matching the packet, and transmitting the rule matching the packet to the virtual switch from the proxy to cause updating of the first set of one or more rules at the virtual switch with the rule transmitted from the proxy.