A method comprising: at a first router associated with a first network node: receiving, from the first network node, one or more packets that identify, as a destination, a particular device identifier associated with a second network node; sending, to a mapping service that maintains a plurality of mappings that associate device identifiers with device locations, a first map lookup request that includes the particular device identifier; receiving, from a second router associated with the second network node, a first map response that includes a particular device location that corresponds to the particular device identifier; characterised by: establishing a secure session between the first router and the second router; determining, based on the secure session, whether the second router is authorized to reply to the first map lookup request that includes the particular device identifier; and if it is determined that the second router is authorized to reply to the first map lookup request that includes the particular device identifier, storing at the first router a local mapping that associates the particular device identifier with the particular device location for the second network node. at a first router associated with a first network node: receiving, from the first network node, one or more packets that identify, as a destination, a particular device identifier associated with a second network node; sending, to a mapping service that maintains a plurality of mappings that associate device identifiers with device locations, a first map lookup request that includes the particular device identifier; receiving, from a second router associated with the second network node, a first map response that includes a particular device location that corresponds to the particular device identifier; characterised by: establishing a secure session between the first router and the second router; determining, based on the secure session, whether the second router is authorized to reply to the first map lookup request that includes the particular device identifier; and if it is determined that the second router is authorized to reply to the first map lookup request that includes the particular device identifier, storing at the first router a local mapping that associates the particular device identifier with the particular device location for the second network node. receiving, from the first network node, one or more packets that identify, as a destination, a particular device identifier associated with a second network node; sending, to a mapping service that maintains a plurality of mappings that associate device identifiers with device locations, a first map lookup request that includes the particular device identifier; receiving, from a second router associated with the second network node, a first map response that includes a particular device location that corresponds to the particular device identifier; characterised by: establishing a secure session between the first router and the second router; determining, based on the secure session, whether the second router is authorized to reply to the first map lookup request that includes the particular device identifier; and if it is determined that the second router is authorized to reply to the first map lookup request that includes the particular device identifier, storing at the first router a local mapping that associates the particular device identifier with the particular device location for the second network node. establishing a secure session between the first router and the second router; determining, based on the secure session, whether the second router is authorized to reply to the first map lookup request that includes the particular device identifier; and if it is determined that the second router is authorized to reply to the first map lookup request that includes the particular device identifier, storing at the first router a local mapping that associates the particular device identifier with the particular device location for the second network node.