A switch, comprising: a storage device ; rule management circuitry configured to store, in the storage device , a first mapping that maps a virtual network identifier of a tunnel to a rule for classifying traffic, wherein the virtual network identifier identifies a virtualized network associated with the tunnel ; network identifier circuitry configured to: generate, for a virtualization manager of a virtual machine , a control packet comprising a representation of the first mapping for a respective local end device; and obtain, from a notification packet from the virtualization manager , a second mapping that maps the virtual network identifier to an identifier of the virtual machine and an identifier of the tunnel ; characterized in that the switch further comprises tunnel management circuitry configured to operate the switch as a tunnel endpoint for the tunnel , wherein the tunnel endpoint is configured to: allocate the virtual network identifier based on a rule defined at the tunnel endpoint ; map the virtual network identifier to one or more corresponding media access control, MAC, addresses based on the rule associated with the virtual network identifier ; and provide the mapping to the virtualization manager . a storage device ; rule management circuitry configured to store, in the storage device , a first mapping that maps a virtual network identifier of a tunnel to a rule for classifying traffic, wherein the virtual network identifier identifies a virtualized network associated with the tunnel ; network identifier circuitry configured to: generate, for a virtualization manager of a virtual machine , a control packet comprising a representation of the first mapping for a respective local end device; and obtain, from a notification packet from the virtualization manager , a second mapping that maps the virtual network identifier to an identifier of the virtual machine and an identifier of the tunnel ; characterized in that the switch further comprises tunnel management circuitry configured to operate the switch as a tunnel endpoint for the tunnel , wherein the tunnel endpoint is configured to: allocate the virtual network identifier based on a rule defined at the tunnel endpoint ; map the virtual network identifier to one or more corresponding media access control, MAC, addresses based on the rule associated with the virtual network identifier ; and provide the mapping to the virtualization manager . generate, for a virtualization manager of a virtual machine , a control packet comprising a representation of the first mapping for a respective local end device; and obtain, from a notification packet from the virtualization manager , a second mapping that maps the virtual network identifier to an identifier of the virtual machine and an identifier of the tunnel ; characterized in that the switch further comprises tunnel management circuitry configured to operate the switch as a tunnel endpoint for the tunnel , wherein the tunnel endpoint is configured to: allocate the virtual network identifier based on a rule defined at the tunnel endpoint ; map the virtual network identifier to one or more corresponding media access control, MAC, addresses based on the rule associated with the virtual network identifier ; and provide the mapping to the virtualization manager . allocate the virtual network identifier based on a rule defined at the tunnel endpoint ; map the virtual network identifier to one or more corresponding media access control, MAC, addresses based on the rule associated with the virtual network identifier ; and provide the mapping to the virtualization manager . <EOS>