1. A method, comprising: intercepting a network flow to a destination node having a network address; sending a discovery query based on a discovery action associated with the network address in a firewall cache; receiving a discovery result from a firewall; sending metadata associated with the network flow to the firewall; and releasing the network flow.