A network device includes a receive module, a port filter, an action generator, processing logic, and a transmit module. The receive module receives a packet and detects whether the packet includes a router media access control (MAC) destination address. The port filter stores Internet Protocol (IP) source and destination addresses, determines whether an IP destination address associated with the packet has been stored, and identifies policy handling information for the packet. The action generator generates, based on the policy handling information, forwarding information for the packet. The forwarding information includes at least a port vector, and, when the IP destination address associated with the packet has been stored, a replacement MAC destination address. The processing logic determines a replacement MAC destination address when the IP destination address associated with the packet has not been stored. The transmit module transmits the packet based on the replacement MAC destination address.