Embodiments include receiving configuration information including a match criterion for packets received at a network device in a network and a pool of layer 3 addresses associated with a set of servers in the network, resolving layer 2 destination addresses based on the layer 3 addresses of the servers, and programming a hardware layer of the network device based, at least in part, on the match criterion, the pool of layer 3 addresses, and the layer 2 destination addresses. Specific embodiments include configuring a policy to indicate that packets from an external source are to be forwarded to a server of the set of servers. Further embodiments include receiving a packet at the network device, and matching the packet to the pool of layer 3 addresses and the resolved layer 2 addresses based, at least in part, on the match criterion programmed in the hardware layer.