Virtual service domains

An apparatus, comprising:

• a processor adapted to execute one or more processes;
• one or more layer-2 (L2) ports;
• one or more virtual service engines (VSEs), each VSE configured to apply a particular service to traffic traversing the VSE between an ingress service port that does not face a corresponding virtual service domain (VSD) to which the VSE is assigned and an egress service port that does face the corresponding VSD;
• a memory configured to store VSD assignments, wherein one or more of the L2 ports are assigned to a particular VSD and wherein each VSD is assigned one or more VSEs in a particular order;
• and
• a virtual Ethernet module (VEM) interconnected with the L2 ports, the ingress service ports of the one or more VSEs, and the egress service ports of the one or more VSEs, the VEM configured to direct traffic received at the VEM according to a set of rules, comprising:
• a) for traffic traversing into a destination VSD, directing the traffic via the one or more correspondingly assigned VSEs in the particular order;
• b) for traffic traversing out of a current VSD, directing the traffic via the one or more correspondingly assigned VSEs in a reverse order from the particular order;
• and
• c) for traffic remaining within a current VSD, directing the traffic without redirection through a VSE.

A tangible computer-readable media having software encoded thereon, the software when executed on a device having one or more layer-2 (L2) ports operable to:

• determine, for at least one of the one or more layer-2 (L2) ports, to which particular virtual service domain (VSD) the at least one L2 port is assigned;
• determine one or more virtual service engines (VSEs) that are assigned to each VSD, the VSEs being assigned in a particular order, each VSE configured to apply a particular service to traffic traversing the VSE between an ingress service port that does not face a corresponding VSD to which the VSE is assigned and an egress service port that does face the corresponding VSD;
• and
• direct traffic within the device according to a set of rules, comprising:
• a) for traffic traversing into a destination VSD, directing the traffic via the one or more correspondingly assigned VSEs in the particular order;
• b) for traffic traversing out of a current VSD, directing the traffic via the one or more correspondingly assigned VSEs in a reverse order from the particular order;
• and
• c) for traffic remaining within a current VSD, directing the traffic without redirection through a VSE.