A method for offloading the application of security policies to balance computing resources within a network fabric , comprising: establishing , by a first switch, a network tunnel between the first switch and a second switch in a network fabric, wherein the second switch enforces security policies for a policy group including a first Endpoint Group, EPG, that are physically connected to the first switch; in response to receiving a communication from the first EPG at the first switch intended for a destination, the communication including a source IP address of the first switch and a Virtual Private Network, VPN, Routing and Forwarding identifier, VRF ID, of the first EPG: modifying , by the first switch, the source IP address with a port offset associated with a port of the first switch to which the first EPG is connected, modifying , by the first switch, the VRF ID with a group offset associated with an identity of the policy group, and transmitting , by the first switch, the communication via the network tunnel from the first switch to the second switch; and in response to receiving the communication over the network tunnel at the second switch from the first switch: identifying , by the second switch, the security policies for the policy group based on the group offset, and in response to determining , by the second switch, that the communication is permitted by the security policies, transmitting , by the second switch, the communication to the destination. establishing , by a first switch, a network tunnel between the first switch and a second switch in a network fabric, wherein the second switch enforces security policies for a policy group including a first Endpoint Group, EPG, that are physically connected to the first switch; in response to receiving a communication from the first EPG at the first switch intended for a destination, the communication including a source IP address of the first switch and a Virtual Private Network, VPN, Routing and Forwarding identifier, VRF ID, of the first EPG: modifying , by the first switch, the source IP address with a port offset associated with a port of the first switch to which the first EPG is connected, modifying , by the first switch, the VRF ID with a group offset associated with an identity of the policy group, and transmitting , by the first switch, the communication via the network tunnel from the first switch to the second switch; and modifying , by the first switch, the source IP address with a port offset associated with a port of the first switch to which the first EPG is connected, modifying , by the first switch, the VRF ID with a group offset associated with an identity of the policy group, and transmitting , by the first switch, the communication via the network tunnel from the first switch to the second switch; and in response to receiving the communication over the network tunnel at the second switch from the first switch: identifying , by the second switch, the security policies for the policy group based on the group offset, and in response to determining , by the second switch, that the communication is permitted by the security policies, transmitting , by the second switch, the communication to the destination. identifying , by the second switch, the security policies for the policy group based on the group offset, and in response to determining , by the second switch, that the communication is permitted by the security policies, transmitting , by the second switch, the communication to the destination. <EOS>