1. In a device, in a network, a method of providing policies to a first and second traffic partition in the network, the method comprising: providing a request for a first and second policy from a policy server; receiving the first policy from the policy server, the first policy indicating processing to be applied to the first traffic partition passing through the device and the first policy defining a first encryption key and first address range within the network; receiving the second policy from the policy server, the second policy indicating processing to be applied to the second traffic partition passing through the device and the second policy defining a second address range within the network; configuring, for the first traffic partition within the device, the first policy within a first routing structure associated with the first traffic partition with the first address range; configuring, for the second traffic partition within the device, the second policy within a second routing structure associated with the second traffic partition with the second address range, the second address range overlapping the first address range; routing a first stream of traffic for the first routing structure in accordance with the first policy for the first routing structure; and routing a second stream of traffic for the second routing structure in accordance with the second policy for the second routing structure.