An Ethernet Metropolitan Area Network (10) provides connectivity to one or more customer premises (161,162,163) to packet-based services, such as ATM, Frame Relay, or IP, while advantageously providing a mechanism for assuring security and regulation of customer traffic. Upon receipt of each customer-generated information frame (20), an ingress Multi-Service Platform (MSP) (122) “tags” the frame with a customer descriptor (22′) that specifically identifies the recipient customer. In practice, the MSP tags each frame by overwriting the Virtual Local Area Network (VLAN) identifier (22) with the customer descriptor. Using the customer descriptor in each frame, a recipient Provider Edge Router (PER) (18) or ATM switch can map the information as appropriate to direct the information to the specific customer at its receiving site. In addition, the customer descriptor (22′) may also include Quality of Service (QoS) information, allowing the recipient Provider Edge Router (PER) (18) or ATM switch to afford the appropriate QoS level accordingly. Each Ethernet switch may advantageously overwrite the VLAN identifier at an incoming port with a second tag associated with an egress port to increase the scale associated with single switch.