diff --git a/dragonflow/controller/apps/classifier.py b/dragonflow/controller/apps/classifier.py
index 5bf0d2bfa..e8ab9b619 100644
--- a/dragonflow/controller/apps/classifier.py
+++ b/dragonflow/controller/apps/classifier.py
@@ -35,7 +35,7 @@ class ClassifierApp(df_base_app.DFlowApp):
         self.add_flow_go_to_table(
             table=const.INGRESS_CLASSIFICATION_DISPATCH_TABLE,
             priority=const.PRIORITY_DEFAULT,
-            goto_table_id=self.dfdp.apps['portsec'].entrypoints.default,
+            goto_table_id=const.INGRESS_CLASSIFICATION_EXITPOINT_TABLE,
         )
 
     @df_base_app.register_event(
diff --git a/dragonflow/controller/common/constants.py b/dragonflow/controller/common/constants.py
index c470212ef..fda29fae4 100644
--- a/dragonflow/controller/common/constants.py
+++ b/dragonflow/controller/common/constants.py
@@ -26,6 +26,7 @@
 # translated to network id and the packet is forwarded to
 # INGRESS_DESTINATION_PORT_LOOKUP_TABLE.
 INGRESS_CLASSIFICATION_DISPATCH_TABLE = 0
+INGRESS_CLASSIFICATION_EXITPOINT_TABLE = 1
 # Detect reg6 (provider network and dNAT)
 EXTERNAL_INGRESS_DETECT_SOURCE_TABLE = 2
 # Next 2 tables are related to connection tracking and packet filtering.
diff --git a/etc/dragonflow_datapath_layout.yaml b/etc/dragonflow_datapath_layout.yaml
index 0716dc765..5999723c9 100644
--- a/etc/dragonflow_datapath_layout.yaml
+++ b/etc/dragonflow_datapath_layout.yaml
@@ -3,6 +3,6 @@ vertices:
     type: portsec
 
 edges:
-  dragonflow-legacy.out.5: portsec.in.default
+  dragonflow-legacy.out.1: portsec.in.default
   portsec.out.default: dragonflow-legacy.in.10
   portsec.out.services: dragonflow-legacy.in.20