1. A method, comprising: intercepting, on a source node, a network flow to a destination node having a network address; determining a discovery action associated with the network address in a firewall cache; sending, from the source node, a discovery query to identify a firewall to be used in a route for sending the network flow to the destination node, wherein the discovery query is based on the discovery action associated with the network address in the firewall cache; receiving, at the source node, a discovery result from the firewall, the discovery result including a firewall address and a firewall port of the firewall; authenticating the discovery result; updating the discovery action in the firewall cache with the firewall address and the firewall port when the discovery result is authenticated; sending metadata associated with the network flow to the firewall; and releasing the network flow from the source node.