According to one embodiment, a method may include assigning a virtual local area network (VLAN) ingress connection identifier (iXid) to a frame upon ingress. The method may also include classifying a traffic flow for which the frame is a part through ingress engines of the network element based on the iXid. The method may further include swapping the iXid for an egress connection identifier (eXid) in the frame. The method may additionally include policing or shaping the traffic flow based on at least one of the iXid and the eXid. Moreover, the method may include classifying the traffic flow through egress engines of the network element based on the eXid.