A method in a network element that includes multiple interfaces for connecting to a communication network includes receiving from the communication network via an ingress interface a flow including a sequence of packets, and routing the packets to a destination of the flow via a first egress interface. A permission indication for re-routing the flow is received in the ingress interface. In response to receiving the permission indication, subsequent packets of the flow are re-routed via a second egress interface that is different from the first egress interface. Further re-routing of the flow is refrained from, until receiving another permission indication.