In one embodiment, a method includes receiving network traffic, determining whether packets have an overlay header, terminating a tunnel and de-encapsulating inner packets of packets having an overlay header, performing services on the inner packets in response to a determination that services are to be performed on the inner packets, originating a tunnel, encapsulating a first packet of the serviced inner packets with an overlay header, and switching the encapsulated serviced inner packets to a destination address in a virtual network in response to determining that the first packet is to be switched to the destination address in the virtual network, and switching a second packet of the serviced inner packets to a destination address in a non-virtual network without encapsulating the serviced inner packets with the overlay header in response to a determination that the second packet is to be switched to the destination address in the non-virtual network.