Tunnel interface for securing traffic over a network

A method comprising:

• creating, within each of a plurality of service processing switches of a managed security service provider, a plurality of virtual routers (VRs), wherein each VR of the plurality of VRs is supported by an object group and each object of the object group supports a managed network service of a plurality of managed network services offered by the managed security service provider to a plurality of subscribers of the managed security service provider via a public Internet Protocol (IP) network;
• assigning one or more VRs of the plurality of VRs to a subscriber of the plurality of subscribers;
• receiving, by a service management system (SMS) of the managed security service provider, a request to establish a Virtual Private Network (VPN) connection between a first premises of the subscriber and a second premises of the subscriber;
• and
• establishing a tunnel in support of the VPN connection between a first service processing switch of the plurality of service processing switches and a second service processing switch of the plurality of service processing switches coupled in communication with the first service processing switch through the public IP network, including:
• configuring a first packet routing node of the first service processing switch, for as long as the VPN connection is maintained, (i) to cause all packets transmitted via the tunnel from the first premises to the second premises to be encrypted prior to transmission through the public IP network and (ii) to cause all packets received via the tunnel from the second premises to be decrypted prior to delivery to an intended recipient associated with the first premises;
• and
• configuring a second packet routing node of the second service processing switch, for as long as the VPN connection is maintained, (i) to cause all packets transmitted via the tunnel from the second premises to the first premises to be encrypted prior to transmission through the public IP network and (ii) to cause all packets received via the tunnel from the first premises to be decrypted prior to delivery to an intended recipient associated with the second premises.