A network device has a network interface to allow the device to send and receive traffic across a network. The device also has a cable connection to allow the device to exchange data with at least one cable modem and a processor to associate a cable interface and cable service identifier with a cable modem; receive a packet from the cable modem; and insert a layer 2 network identifier, the identifier comprising two service provider VLAN (SP-VLAN) tags, into the packet. The processor in the network device identifies a virtual trunk interface based on the outer SP-VLAN tag and identifies the virtual private network based on the inner SP-VLAN tag.