A method of providing by an intermediary device access to a service deployed in parallel to the intermediary device, the method comprising: (a) receiving, by an intermediary device deployed between a plurality of clients and one or more servers, a request from a client to access a server via a first, transport layer connection; (b) applying a policy to at least one of header information of the request or a body of the request to determine whether or not to forward the request to one of a plurality of parallel devices for processing; (c) determining, by the intermediary device responsive to applying the policy, that, the request is to be processed by a specific service as well as a specific device selected from the plurality of parallel devices, wherein the specific device is a second device, wherein the specific service is selected from one of a single sign on service or a firewall service; (d) identifying, from the policy, responsive to determining that the request is to be processed by the specific service provided by a second device, an identity of the specific service that is to process the request and an identity of the second device on which the specific service is to process the request, the second device deployed in parallel to the intermediary device; (e) forwarding, by the intermediary device, the request via a second transport layer connection to the second device for processing by the service, the request modified by the intermediary device to change a Media Access Control address of a destination of the request to a MAC address of the second device; (f) receiving, by the intermediary device, a response to processing the request from the service of the second device; (g) identifying, by the intermediary device, that the response is from the second device via one or more properties of a transport layer connection carrying the response and the response comprising information to identify that the specific service on the second device has processed the request; and (h) continuing processing, by the intermediary device, the request responsive to receiving the response from the second device. (a) receiving, by an intermediary device deployed between a plurality of clients and one or more servers, a request from a client to access a server via a first, transport layer connection; (b) applying a policy to at least one of header information of the request or a body of the request to determine whether or not to forward the request to one of a plurality of parallel devices for processing; (c) determining, by the intermediary device responsive to applying the policy, that, the request is to be processed by a specific service as well as a specific device selected from the plurality of parallel devices, wherein the specific device is a second device, wherein the specific service is selected from one of a single sign on service or a firewall service; (d) identifying, from the policy, responsive to determining that the request is to be processed by the specific service provided by a second device, an identity of the specific service that is to process the request and an identity of the second device on which the specific service is to process the request, the second device deployed in parallel to the intermediary device; (e) forwarding, by the intermediary device, the request via a second transport layer connection to the second device for processing by the service, the request modified by the intermediary device to change a Media Access Control address of a destination of the request to a MAC address of the second device; (f) receiving, by the intermediary device, a response to processing the request from the service of the second device; (g) identifying, by the intermediary device, that the response is from the second device via one or more properties of a transport layer connection carrying the response and the response comprising information to identify that the specific service on the second device has processed the request; and (h) continuing processing, by the intermediary device, the request responsive to receiving the response from the second device.