Flowchart 500 can be implemented at least partially with a computer or other data processing system; that is, by one or more processors configured to receive or retrieve information, process the information, store results, and transmit the results. Other implementations may perform the actions in different orders and/or with different, fewer or additional actions than those illustrated in FIG. 5. Multiple actions can be combined in some implementations. For convenience, this flowchart is described with reference to a system which includes Netskope cloud access security broker (N-CASB) and load balancing in a dynamic service chain while applying security services in the cloud.

The method described in this section and other sections of the technology disclosed can include one or more of the following features and/or features described in connection with additional methods disclosed. In the interest of conciseness, the combinations of features disclosed in this application are not individually enumerated and are not repeated with each base set of features.

FIG. 5 begins with action 515 for processing a packet for a subscriber at a first service pod that performs a first security service in a service chain.

Process 500 continues at action 525, based on the processing, determining a second service, among at least second and third services which the subscriber has selected, that should next handle the packet.

Action 535 includes accessing a flow table using outer IP header data carried by the packet to select a second service pod, from among a plurality of service pods performing the second service, which perform the second service in the service chain.