1. A method, comprising: receiving, at an Internet Key Exchange (IKE) processing node in a cloud, a request for a cloud capability set comprising cloud capabilities associated with at least one of a plurality of service tiers, each service tier in the plurality of service tiers being associated with a different cloud capability set, the cloud capability set being selectable at a self-service portal of a cloud orchestration framework, the request being associated with a virtual private network (VPN) tunnel between a subscriber and the IKE processing node; selecting particular cryptographic modules from a plurality of cryptographic modules located in the cloud based on the request, wherein different cryptographic modules support different cloud capability sets, wherein the particular cryptographic modules support the requested cloud capability set; offloading, by the IKE processing node, the VPN tunnel to the particular cryptographic modules in the cloud; and configuring, by an orchestration engine in the cloud, network resources in the cloud to channel services according to the at least one service tier through the particular cryptographic modules.