Using PNICS to perform firewall operations

A non-transitory machine readable medium storing a program for execution by at least one processing unit for offloading firewall operations from a host computer executing a set of one or more virtual machines (VMs) to a physical network interface card (PNIC) connected to the host computer, the program comprising sets of instructions for:

• configuring on the PNIC having an embedded hardware switch:
• a first firewall (i) to determine actions to perform on data message flows associated with the set of VMs, (ii) to offload processing of the data message flows to a flow-cache second firewall of the PNIC, and (iii) to indicate, for each data message flow, whether or not the processing thereof can be further offloaded to the embedded hardware switch;
• the flow-cache second firewall (i) to process a first set of data message flows based on a first set of actions determined by the first firewall, and (ii) to offload processing of a second set of data message flows to the embedded hardware switch of the PNIC based on indications by the first firewall that the processing of each of the data message flows in the second set can be offloaded to the embedded hardware switch;
• and
• the embedded hardware switch to process the second set of data message flows based on a second set of actions determined by the first firewall.