Hybrid services insertion

An apparatus comprising:

• at least one hardware module of a network device having a plurality of ports, the at least one hardware module configured to store attributes for at least one access control list and associated actions that cause network packets received at one of the plurality of ports that match the attributes for the at least one access control list, to be directed into a service chain that includes at least a first network processing application specified according to a port and a second network processing application specified according to an internet protocol (IP) address;
• and
• a processor configured to communicate with the at least one hardware module and to direct a received network packet that matches the attributes for the at least one access control list into the service chain.

One or more non-transitory computer readable storage media encoded with instructions that, when executed by a processor, cause the processor to:

• store, in at least one hardware module of a network device having a plurality of ports, attributes for at least one access control list and associated actions that cause network packets received at one of the plurality of ports that match the attributes for the at least one access control list, to be directed into a service chain that includes at least a first network processing application specified according to a port and a second network processing application specified according to an internet protocol (IP) address;
• and
• direct a received network packet that matches the attributes for the at least one access control list into the service chain.