Patent ID: 8274973

Claim:
A method, comprising: assigning each of one or more layer-2 (L2) ports of a network device to a particular virtual service domain (VSD), each L2 port interconnected with a virtual Ethernet module (VEM) of the device; assigning to each VSD one or more virtual service engines (VSEs) in a particular order, each VSE configured to apply a particular service to traffic traversing the VSE between an ingress service port that does not face a corresponding VSD to which the VSE is assigned and an egress service port that does face the corresponding VSD, the ingress and egress service ports interconnected with the VEM; and directing traffic received at the VEM according to a set of rules, comprising: a) for traffic traversing into a destination VSD, directing the traffic via the one or more correspondingly assigned VSEs in the particular order; b) for traffic traversing out of a current VSD, directing the traffic via the one or more correspondingly assigned VSEs in a reverse order from the particular order; and c) for traffic remaining within a current VSD, directing the traffic without redirection through a VSE.