A map server/map resolver (MS/MR) of a Locator ID Separation Protocol (LISP) control plane for an enterprise private network for group-based service insertion is described. The MS/MR may facilitate communications from a first host having a first endpoint ID (EID) and located at a first tunnel router having a first routing locator (RLOC), to a second host having a second EID and located at a second tunnel router having a second RLOC. The MS/MR receives, from the first tunnel router, a map request for requesting an EID-to-RLOC mapping associated with the second EID and including a group identifier. The MS/MR selects a service insertion policy including an address of a service border router for a service that is registered with the MS/MR, and responds with a map reply including the address for populating an overlay route for forwarding communications via the service border router for insertion of the registered service.