...

• sync mechanism to keep the configuration of OVS switches and flow rules are consistent with topology (how it spans the physical hosts) of VPC and ingress/egress ACL's applies on the tiers 
• when possible fall back to data path where packet is sent to VPC VR, so that optimization achieved with distributed routing and network acls is not leveraged but functionality is not lost because VPC VR will perform ACL and routing anyway.

Architecture & Design description

...