Aspects of the disclosure provide a method for processing packets in a network device. The method can include populating a policy database with one or more bidirectional rules that are to be selectively applied in a packet processing operation. Ones of the bidirectional rules can include at least: a first address field populated with a first value corresponding to a source address for first packet flow that is traversing a network in a first direction and to a destination address for second packet flow that is traversing the network in a second direction different from the first direction, a second address field populated with a second value, and an action that is applicable to packet flow having a respective source address and destination address corresponding to the first values stored in the first address field and to the second values stored in the second address field.