A switch, comprising: a storage device; rule management circuitry configured to store, in the storage device, a first mapping that maps a virtual network identifier (162, 164) of a tunnel to a rule (172, 174) for classifying traffic, wherein the virtual network identifier (162, 164) identifies a virtualized network associated with the tunnel; network identifier circuitry configured to: generate, for a virtualization manager of a virtual machine (122, 123, 124, 125, 126, 127, 128, 129, 122, 123, 124, 125), a control packet comprising a representation of the first mapping for a respective local end device; and obtain, from a notification packet from the virtualization manager, a second mapping that maps the virtual network identifier (162, 164) to an identifier of the virtual machine and an identifier of the tunnel; characterized in that the switch further comprises tunnel management circuitry configured to operate the switch as a tunnel endpoint (102, 104) for the tunnel; wherein the tunnel management circuitry is further configured to enable the virtualization manager to create and manage a set of virtual machines (122, 123, 124, 125, 126, 127, 128, 129, 122, 123, 124, 125); upon receiving the second mapping from the tunnel endpoint (102, 104), the virtualization manager maps virtual MAC addresses of the virtual machines to corresponding virtual network identifiers (162, 164) and provides the mapping to the tunnel endpoint (102, 104); and the tunnel endpoint (102, 104) updates a local MAC address table based on the mapping received from the virtualization manager. a storage device; rule management circuitry configured to store, in the storage device, a first mapping that maps a virtual network identifier (162, 164) of a tunnel to a rule (172, 174) for classifying traffic, wherein the virtual network identifier (162, 164) identifies a virtualized network associated with the tunnel; network identifier circuitry configured to: generate, for a virtualization manager of a virtual machine (122, 123, 124, 125, 126, 127, 128, 129, 122, 123, 124, 125), a control packet comprising a representation of the first mapping for a respective local end device; and obtain, from a notification packet from the virtualization manager, a second mapping that maps the virtual network identifier (162, 164) to an identifier of the virtual machine and an identifier of the tunnel; characterized in that the switch further comprises tunnel management circuitry configured to operate the switch as a tunnel endpoint (102, 104) for the tunnel; wherein the tunnel management circuitry is further configured to enable the virtualization manager to create and manage a set of virtual machines (122, 123, 124, 125, 126, 127, 128, 129, 122, 123, 124, 125); upon receiving the second mapping from the tunnel endpoint (102, 104), the virtualization manager maps virtual MAC addresses of the virtual machines to corresponding virtual network identifiers (162, 164) and provides the mapping to the tunnel endpoint (102, 104); and the tunnel endpoint (102, 104) updates a local MAC address table based on the mapping received from the virtualization manager. generate, for a virtualization manager of a virtual machine (122, 123, 124, 125, 126, 127, 128, 129, 122, 123, 124, 125), a control packet comprising a representation of the first mapping for a respective local end device; and obtain, from a notification packet from the virtualization manager, a second mapping that maps the virtual network identifier (162, 164) to an identifier of the virtual machine and an identifier of the tunnel; characterized in that the switch further comprises tunnel management circuitry configured to operate the switch as a tunnel endpoint (102, 104) for the tunnel; wherein the tunnel management circuitry is further configured to enable the virtualization manager to create and manage a set of virtual machines (122, 123, 124, 125, 126, 127, 128, 129, 122, 123, 124, 125); upon receiving the second mapping from the tunnel endpoint (102, 104), the virtualization manager maps virtual MAC addresses of the virtual machines to corresponding virtual network identifiers (162, 164) and provides the mapping to the tunnel endpoint (102, 104); and the tunnel endpoint (102, 104) updates a local MAC address table based on the mapping received from the virtualization manager.