A switch, comprising: a storage device; rule management circuitry configured to store, in the storage device, a first mapping that maps a virtual network identifier (162, 164) of a tunnel to a rule (172, 174) for classifying traffic, wherein the virtual network identifier (162, 164) identifies a virtualized network associated with the tunnel; network identifier circuitry configured to: generate, for a virtualization manager of a virtual machine (122, 123, 124, 125, 126, 127, 128, 129, 122, 123, 124, 125), a control packet comprising a representation of the first mapping for a respective local end device; and obtain, from a notification packet from the virtualization manager, a second mapping that maps the virtual network identifier (162, 164) to an identifier of the virtual machine and an identifier of the tunnel; characterized in that the switch (201, 202, 203, 205, 210, 500) further comprises tunnel management circuitry configured to operate the switch as a tunnel endpoint (102, 104) for the tunnel, wherein the tunnel endpoint (102, 104) is configured to: allocate the virtual network identifier (162, 164) based on a rule defined at the tunnel endpoint (102, 104); map the virtual network identifier (162, 164) to one or more corresponding media access control, MAC, addresses based on the rule associated with the virtual network identifier (162, 164); and provide the mapping to the virtualization manager. a storage device; rule management circuitry configured to store, in the storage device, a first mapping that maps a virtual network identifier (162, 164) of a tunnel to a rule (172, 174) for classifying traffic, wherein the virtual network identifier (162, 164) identifies a virtualized network associated with the tunnel; network identifier circuitry configured to: generate, for a virtualization manager of a virtual machine (122, 123, 124, 125, 126, 127, 128, 129, 122, 123, 124, 125), a control packet comprising a representation of the first mapping for a respective local end device; and obtain, from a notification packet from the virtualization manager, a second mapping that maps the virtual network identifier (162, 164) to an identifier of the virtual machine and an identifier of the tunnel; characterized in that the switch (201, 202, 203, 205, 210, 500) further comprises tunnel management circuitry configured to operate the switch as a tunnel endpoint (102, 104) for the tunnel, wherein the tunnel endpoint (102, 104) is configured to: allocate the virtual network identifier (162, 164) based on a rule defined at the tunnel endpoint (102, 104); map the virtual network identifier (162, 164) to one or more corresponding media access control, MAC, addresses based on the rule associated with the virtual network identifier (162, 164); and provide the mapping to the virtualization manager. generate, for a virtualization manager of a virtual machine (122, 123, 124, 125, 126, 127, 128, 129, 122, 123, 124, 125), a control packet comprising a representation of the first mapping for a respective local end device; and obtain, from a notification packet from the virtualization manager, a second mapping that maps the virtual network identifier (162, 164) to an identifier of the virtual machine and an identifier of the tunnel; characterized in that the switch (201, 202, 203, 205, 210, 500) further comprises tunnel management circuitry configured to operate the switch as a tunnel endpoint (102, 104) for the tunnel, wherein the tunnel endpoint (102, 104) is configured to: allocate the virtual network identifier (162, 164) based on a rule defined at the tunnel endpoint (102, 104); map the virtual network identifier (162, 164) to one or more corresponding media access control, MAC, addresses based on the rule associated with the virtual network identifier (162, 164); and provide the mapping to the virtualization manager. allocate the virtual network identifier (162, 164) based on a rule defined at the tunnel endpoint (102, 104); map the virtual network identifier (162, 164) to one or more corresponding media access control, MAC, addresses based on the rule associated with the virtual network identifier (162, 164); and provide the mapping to the virtualization manager.