A method comprising: providing, in a network environment, one or more service zones (100, 120), each service zone including a plurality of instances of an in-line application service (110, 130) to be applied to network traffic and one or more routers (112, 114, 116, 122, 124, 126) to direct network traffic to the plurality of services; assigning a route target to each service zone to serve as a community value for route import and export between routers of other service zones, destination networks or source networks via a control protocol; an edge router (116, 126) in each service zone or destination network advertising routes by its destination network prefix tagged with its route target; creating a service chain by importing and exporting of destination network prefixes by way of route targets at edge routers of the service zones or source networks; and determining which of the plurality of in-line application service instances to direct traffic to in the particular service zone; the method further comprising: providing a plurality of virtual routing and forwarding, VRF, functions in the edge router at which traffic is received in a particular service zone and a plurality of attachment circuits (118, 128) is connected between VRF functions and in-line application service instances, each VRF function storing data maintaining a corresponding one of the attachment circuits for traffic flow to and from a corresponding in-line application service instance; and providing a session routing and forwarding, SRF, function that stores session information to select which attachment circuits to use, as stored by the VRF functions, for purposes of directing traffic received at the edge router of the particular service zone to in-line application service instances and receiving traffic back from the in-line application service instances, the session information representing assignment of packet sessions to attachment circuits for delivery to in-line application service instances according to session flow parameters of the packets. providing, in a network environment, one or more service zones (100, 120), each service zone including a plurality of instances of an in-line application service (110, 130) to be applied to network traffic and one or more routers (112, 114, 116, 122, 124, 126) to direct network traffic to the plurality of services; assigning a route target to each service zone to serve as a community value for route import and export between routers of other service zones, destination networks or source networks via a control protocol; an edge router (116, 126) in each service zone or destination network advertising routes by its destination network prefix tagged with its route target; creating a service chain by importing and exporting of destination network prefixes by way of route targets at edge routers of the service zones or source networks; and determining which of the plurality of in-line application service instances to direct traffic to in the particular service zone; the method further comprising: providing a plurality of virtual routing and forwarding, VRF, functions in the edge router at which traffic is received in a particular service zone and a plurality of attachment circuits (118, 128) is connected between VRF functions and in-line application service instances, each VRF function storing data maintaining a corresponding one of the attachment circuits for traffic flow to and from a corresponding in-line application service instance; and providing a session routing and forwarding, SRF, function that stores session information to select which attachment circuits to use, as stored by the VRF functions, for purposes of directing traffic received at the edge router of the particular service zone to in-line application service instances and receiving traffic back from the in-line application service instances, the session information representing assignment of packet sessions to attachment circuits for delivery to in-line application service instances according to session flow parameters of the packets. providing a plurality of virtual routing and forwarding, VRF, functions in the edge router at which traffic is received in a particular service zone and a plurality of attachment circuits (118, 128) is connected between VRF functions and in-line application service instances, each VRF function storing data maintaining a corresponding one of the attachment circuits for traffic flow to and from a corresponding in-line application service instance; and providing a session routing and forwarding, SRF, function that stores session information to select which attachment circuits to use, as stored by the VRF functions, for purposes of directing traffic received at the edge router of the particular service zone to in-line application service instances and receiving traffic back from the in-line application service instances, the session information representing assignment of packet sessions to attachment circuits for delivery to in-line application service instances according to session flow parameters of the packets.