A method for exchanging data across at least first and second different cloud service providers using a network node (N1), comprising: receiving , at the network node (N1), a virtual routing table, VRT associated with a tenant, wherein the VRT indicates an association with a virtual local area network, VLAN , defines that a first node (C1) of a first cloud service provider and a second node (C2) of a second cloud service provider are neighbors of the network node (N1), and specifies a route between the neighbors via the network node, the route having a route definition, wherein the route definition creates a private transitive network between the neighbors via the network node; receiving , by the network node (N1), from the first node (C1) associated with the tenant of the first cloud service provider, a first message destined for the second node (C2) of the second cloud service provider, the first message having a first additional header field and a first internet protocol (IP) message; determining , by the network node (N1), that the first message employs the route specified by the VRT using the first additional header field; forwarding , by the network node (N1), the first message to the second node (C2) to process the first IP message; receiving , by the network node (N1), from a third node (C3) associated with a different tenant of the first cloud service provider, a second message destined for the second node (C2), the second message having a second additional header field and a second IP message; determining , by the network node (N1), that the second message does not employ the route specified by the VRT using the second additional header field; and failing , by the network node (N1), to forward the second message to the second node (C2). receiving , at the network node (N1), a virtual routing table, VRT associated with a tenant, wherein the VRT indicates an association with a virtual local area network, VLAN , defines that a first node (C1) of a first cloud service provider and a second node (C2) of a second cloud service provider are neighbors of the network node (N1), and specifies a route between the neighbors via the network node, the route having a route definition, wherein the route definition creates a private transitive network between the neighbors via the network node; receiving , by the network node (N1), from the first node (C1) associated with the tenant of the first cloud service provider, a first message destined for the second node (C2) of the second cloud service provider, the first message having a first additional header field and a first internet protocol (IP) message; determining , by the network node (N1), that the first message employs the route specified by the VRT using the first additional header field; forwarding , by the network node (N1), the first message to the second node (C2) to process the first IP message; receiving , by the network node (N1), from a third node (C3) associated with a different tenant of the first cloud service provider, a second message destined for the second node (C2), the second message having a second additional header field and a second IP message; determining , by the network node (N1), that the second message does not employ the route specified by the VRT using the second additional header field; and failing , by the network node (N1), to forward the second message to the second node (C2). <EOS>