A method for exchanging data across at least first and second different cloud service providers using a network node, comprising: receiving, at the network node, a virtual routing table, VRT (10, 11, 12) associated with a tenant, wherein the VRT indicates an association with a virtual local area network, VLAN (10, 11, 12), defines that a first node of a first cloud service provider and a second node of a second cloud service provider are neighbors of the network node, and specifies a route between the neighbors via the network node, the route having a route definition, wherein the route definition creates a private transitive network between the neighbors via the network node; receiving, by the network node, from the first node associated with the tenant of the first cloud service provider, a first message destined for the second node of the second cloud service provider, the first message having a first additional header field and a first internet protocol message; determining, by the network node, that the first message employs the route specified by the VRT using the first additional header field; forwarding, by the network node, the first message to the second node to process the first IP message; receiving, by the network node, from a third node associated with a different tenant of the first cloud service provider, a second message destined for the second node, the second message having a second additional header field and a second IP message; determining, by the network node, that the second message does not employ the route specified by the VRT using the second additional header field; and failing, by the network node, to forward the second message to the second node. receiving, at the network node, a virtual routing table, VRT (10, 11, 12) associated with a tenant, wherein the VRT indicates an association with a virtual local area network, VLAN (10, 11, 12), defines that a first node of a first cloud service provider and a second node of a second cloud service provider are neighbors of the network node, and specifies a route between the neighbors via the network node, the route having a route definition, wherein the route definition creates a private transitive network between the neighbors via the network node; receiving, by the network node, from the first node associated with the tenant of the first cloud service provider, a first message destined for the second node of the second cloud service provider, the first message having a first additional header field and a first internet protocol message; determining, by the network node, that the first message employs the route specified by the VRT using the first additional header field; forwarding, by the network node, the first message to the second node to process the first IP message; receiving, by the network node, from a third node associated with a different tenant of the first cloud service provider, a second message destined for the second node, the second message having a second additional header field and a second IP message; determining, by the network node, that the second message does not employ the route specified by the VRT using the second additional header field; and failing, by the network node, to forward the second message to the second node.