1. A method comprising: provisioning physical network service equipment with a service context for each of a plurality of tenants; configuring the physical network service equipment with multiple policies, each policy within a service context for a particular tenant and having a policy identifier, and one virtual local area network (VLAN) being associated with each policy; for a virtual workload that uses an overlay technology, receiving an identifier of a logical network to which the virtual workload connects and a policy for the logical network; and based on the identifier of the logical network and the policy, configuring a gateway to connect traffic for the virtual workload on the logical network to a particular VLAN interface of the physical network service equipment on which the policy is configured.