A method for a network device to perform service insertion in a public cloud environment that includes a first virtual network and a second virtual network, wherein the method comprises: in response to receiving, by the network device, a first encapsulated packet from a first virtualized computing instance located in the first virtual network, generating, by the network device, a decapsulated packet by performing decapsulation to remove, from the first encapsulated packet, a first outer header that is addressed from the first virtualized computing instance to the network device; based on one or more characteristics of the decapsulated packet, identifying, by the network device, a service path specified by a service insertion rule, wherein the service path and the network device are both located in the second virtual network; sending, by the network device, the decapsulated packet to the service path to cause the service path to process the decapsulated packet according to one or more services; and in response to the network device receiving the decapsulated packet processed by the service path, sending, by the network device, the decapsulated packet towards a destination address of the decapsulated packet, or generating and sending, by the network device, a second encapsulated packet that includes a second outer header and the decapsulated packet, towards a destination address of the decapsulated packet, wherein sending the decapsulated packet to the service path comprises: based on the service insertion rule, sending the decapsulated packet to a first service virtualized computing instance located on the service path in the second virtual network, and identifying, by the network device, that the first service virtualized computing instance is assigned with an active role for using an active-standby configuration, based on a control-plane advertisement or a data-plane probe from the first service virtualized computing instance, wherein the first service virtualized computing instance and a second service virtualized computing instance located on the service path, are configured as a high availability, HA, pair. in response to receiving, by the network device, a first encapsulated packet from a first virtualized computing instance located in the first virtual network, generating, by the network device, a decapsulated packet by performing decapsulation to remove, from the first encapsulated packet, a first outer header that is addressed from the first virtualized computing instance to the network device; based on one or more characteristics of the decapsulated packet, identifying, by the network device, a service path specified by a service insertion rule, wherein the service path and the network device are both located in the second virtual network; sending, by the network device, the decapsulated packet to the service path to cause the service path to process the decapsulated packet according to one or more services; and generating, by the network device, a decapsulated packet by performing decapsulation to remove, from the first encapsulated packet, a first outer header that is addressed from the first virtualized computing instance to the network device; based on one or more characteristics of the decapsulated packet, identifying, by the network device, a service path specified by a service insertion rule, wherein the service path and the network device are both located in the second virtual network; sending, by the network device, the decapsulated packet to the service path to cause the service path to process the decapsulated packet according to one or more services; and in response to the network device receiving the decapsulated packet processed by the service path, sending, by the network device, the decapsulated packet towards a destination address of the decapsulated packet, or generating and sending, by the network device, a second encapsulated packet that includes a second outer header and the decapsulated packet, towards a destination address of the decapsulated packet, sending, by the network device, the decapsulated packet towards a destination address of the decapsulated packet, or generating and sending, by the network device, a second encapsulated packet that includes a second outer header and the decapsulated packet, towards a destination address of the decapsulated packet, wherein sending the decapsulated packet to the service path comprises: based on the service insertion rule, sending the decapsulated packet to a first service virtualized computing instance located on the service path in the second virtual network, and identifying, by the network device, that the first service based on the service insertion rule, sending the decapsulated packet to a first service virtualized computing instance located on the service path in the second virtual network, and identifying, by the network device, that the first service virtualized computing instance is assigned with an active role for using an active-standby configuration, based on a control-plane advertisement or a data-plane probe from the first service virtualized computing instance, wherein the first service virtualized computing instance and a second service virtualized computing instance located on the service path, are configured as a high availability, HA, pair.