A network router comprising: a plurality of interfaces configured to send and receive packets; a firewall integrated within the network router, the firewall configured to apply stateful firewall services to the packets; a routing engine comprising a control unit configured to execute a routing protocol to maintain routing information specifying routes through a network, wherein the control unit is configured to execute at least one protocol to establish virtual private network,VPN, tunnels for one or more customer VPNs, and to execute a network services protocol that communicates mapping information between the routing engine and the firewall, wherein the mapping information associates multi-protocol label switched,MPLS, VPN labels for the VPNs with the identifiers for the customer VPNs; a forwarding engine configured by the routing engine to select next hops for the packets in accordance with the routing information, the forwarding engine comprising a switch fabric to forward the packets to the interfaces based on the selected next hops, wherein the forwarding engine includes a flow control module that, upon receiving packets from the network, is configured to direct one or more of the packets to the firewall for application of the stateful firewall services; and a user interface by which a user specifies one or more zones to be recognized by the firewall when applying the stateful firewall services to the packets, each of the zones defined by a list of one or more of the interfaces, wherein the user interface is configured to support a syntax that allows the user to define the zones by specifying the customer VPNs within lists of interfaces associated with the zones; wherein, based on the mapping information, the firewall is configured to apply policies to multi-protocol label switched,MPLS, packets received from the forwarding engine. a plurality of interfaces configured to send and receive packets; a firewall integrated within the network router, the firewall configured to apply stateful firewall services to the packets; a routing engine comprising a control unit configured to execute a routing protocol to maintain routing information specifying routes through a network, wherein the control unit is configured to execute at least one protocol to establish virtual private network,VPN, tunnels for one or more customer VPNs, and to execute a network services protocol that communicates mapping information between the routing engine and the firewall, wherein the mapping information associates multi-protocol label switched,MPLS, VPN labels for the VPNs with the identifiers for the customer VPNs; a forwarding engine configured by the routing engine to select next hops for the packets in accordance with the routing information, the forwarding engine comprising a switch fabric to forward the packets to the interfaces based on the selected next hops, wherein the forwarding engine includes a flow control module that, upon receiving packets from the network, is configured to direct one or more of the packets to the firewall for application of the stateful firewall services; and a user interface by which a user specifies one or more zones to be recognized by the firewall when applying the stateful firewall services to the packets, each of the zones defined by a list of one or more of the interfaces, wherein the user interface is configured to support a syntax that allows the user to define the zones by specifying the customer VPNs within lists of interfaces associated with the zones; wherein, based on the mapping information, the firewall is configured to apply policies to multi-protocol label switched,MPLS, packets received from the forwarding engine.