Data traffic is routed from a customer edge (CE) router to an Ethernet services router via a generic routing encapsulation (GRE) tunnel. Upon routing the data traffic from the CE router to the Ethernet services router, the data traffic is routed from the Ethernet services router to an aggregation switch. Upon routing the data traffic from the Ethernet services router to the aggregation switch, the data traffic is routed from the aggregation switch to a service switch through a security module, the security module configured to filter the data traffic. The filtered data traffic is routed from the service switch to the Ethernet services router. Upon routing the filtered data traffic from the service switch to the Ethernet services router, the filtered data traffic is routed from the Ethernet services router to a provider edge (PE) router.