In one implementation, sub-interfaces are defined in Layer three (L3) tunnels, such as generic routing encapsulization (GRE) or Internet protocol security (IPsec) tunnels. Sub-interfaces inside a L3 tunnel may be preferred to using several L3 tunnels. The flow label of the tunnel header is used to define sub-interfaces of a tunnel interface. The flow label is populated with a routing instance identifier to index the sub-interfaces.