A method of forwarding a packet, characterised by comprising: receiving, by a switch, a packet via a port on a chip on which at least two ports including the receiving port are in the same Virtual Local Area Network but belong to different Multitenant Devices Contexts (MDCs); when the packet is a layer-2 packet, determining, by the switch, a Virtual Switch Instance based on an identification of a Multitenant Devices Context to which the port belongs and an ID of a Virtual Local Area Network (VLAN) to which the packet belongs, searching, by the switch, for a layer-2 entry stored in a chip where the port is located and matching with the VSI and a destination Media Access Control address of the packet, and forwarding, by the switch, the packet based on the matching layer-2 entry; and when the packet is a layer-3 packet, determining, by the switch, a second VPN Routing and Forwarding instance based on the ID of the MDC to which the port belongs and an ID of a first VRF to which the packet belongs, searching, by the switch, for a layer-3 entry stored in the chip where the port is located and matching with the second VRF and a destination Internet Protocol address of the packet, and forwarding, by the switch, the packet based on the matching layer-3 entry. receiving, by a switch, a packet via a port on a chip on which at least two ports including the receiving port are in the same Virtual Local Area Network but belong to different Multitenant Devices Contexts (MDCs); when the packet is a layer-2 packet, determining, by the switch, a Virtual Switch Instance based on an identification of a Multitenant Devices Context to which the port belongs and an ID of a Virtual Local Area Network (VLAN) to which the packet belongs, searching, by the switch, for a layer-2 entry stored in a chip where the port is located and matching with the VSI and a destination Media Access Control address of the packet, and forwarding, by the switch, the packet based on the matching layer-2 entry; and when the packet is a layer-3 packet, determining, by the switch, a second VPN Routing and Forwarding instance based on the ID of the MDC to which the port belongs and an ID of a first VRF to which the packet belongs, searching, by the switch, for a layer-3 entry stored in the chip where the port is located and matching with the second VRF and a destination Internet Protocol address of the packet, and forwarding, by the switch, the packet based on the matching layer-3 entry. determining, by the switch, a Virtual Switch Instance based on an identification of a Multitenant Devices Context to which the port belongs and an ID of a Virtual Local Area Network (VLAN) to which the packet belongs, searching, by the switch, for a layer-2 entry stored in a chip where the port is located and matching with the VSI and a destination Media Access Control address of the packet, and forwarding, by the switch, the packet based on the matching layer-2 entry; and when the packet is a layer-3 packet, determining, by the switch, a second VPN Routing and Forwarding instance based on the ID of the MDC to which the port belongs and an ID of a first VRF to which the packet belongs, searching, by the switch, for a layer-3 entry stored in the chip where the port is located and matching with the second VRF and a destination Internet Protocol address of the packet, and forwarding, by the switch, the packet based on the matching layer-3 entry.