diff --git a/xos/configurations/cord-pod/README.md b/xos/configurations/cord-pod/README.md
index e9b1327..2c74c15 100644
--- a/xos/configurations/cord-pod/README.md
+++ b/xos/configurations/cord-pod/README.md
@@ -92,7 +92,7 @@
 
 If you're not using the fabric then the default values should be OK.  
 
-XOS can then be brought up for CORD by running a few 'make' commands:
+XOS can then be brought up for CORD by running a few `make` commands:
 ```
 ubuntu@xos:~/xos/xos/configurations/cord-pod$ make
 ubuntu@xos:~/xos/xos/configurations/cord-pod$ make vtn
@@ -101,3 +101,37 @@
 
 After the first 'make' command above, you will be able to login to XOS at
 *http://xos/* using username/password `padmin@vicci.org/letmein`.
+
+### Inspecting the vSG
+
+The above series of `make` commands will spin up a vSG for a sample subscriber.  The 
+vSG is implemented as a Docker container (using the 
+[andybavier/docker-vcpe](https://hub.docker.com/r/andybavier/docker-vcpe/) image 
+hosted on Docker Hub) running inside an Ubuntu VM.  Once the VM is created, you
+can login as the `ubuntu` user at the management network IP (172.27.0.x) on the compute node
+hosting the VM, using the private key generated on the head node by the install process.
+For example, in the single-node development POD configuration, you can login to the VM 
+with management IP 172.27.0.2 using a ProxyCommand as follows:
+
+```
+ubuntu@pod:~$ ssh -o ProxyCommand="ssh -W %h:%p ubuntu@nova-compute" ubuntu@172.27.0.2
+```
+
+Alternatively, you could copy the generated private key to the compute node 
+and login from there:
+
+```
+ubuntu@pod:~$ scp ~/.ssh/id_rsa ubuntu@nova-compute:~/.ssh
+ubuntu@pod:~$ ssh ubuntu@nova-compute
+ubuntu@nova-compute:~$ ssh ubuntu@172.27.0.2
+```
+
+Once logged in to the VM, you can run `sudo docker ps` to see the running 
+vSG containers:
+
+```
+ubuntu@mysite-vsg-1:~$ sudo docker ps
+CONTAINER ID        IMAGE                    COMMAND             CREATED             STATUS              PORTS               NAMES
+2b0bfb3662c7        andybavier/docker-vcpe   "/sbin/my_init"     5 days ago          Up 5 days                               vcpe-222-111
+```
+
diff --git a/xos/core/models/service.py b/xos/core/models/service.py
index aca4bb0..96bff36 100644
--- a/xos/core/models/service.py
+++ b/xos/core/models/service.py
@@ -188,6 +188,9 @@
 #                if ns.network.template.access in ["direct", "indirect"]:
 #                    # skip access networks; we want to use the private network
 #                    continue
+                if "management" in ns.network.name:
+                    # don't try to connect the management network to anything
+                    continue
                 if ns.network.name in ["wan_network", "lan_network"]:
                     # we don't want to attach to the vCPE's lan or wan network
                     # we only want to attach to its private network
diff --git a/xos/tosca/samples/vtn-service-chain.yaml b/xos/tosca/samples/vtn-service-chain.yaml
new file mode 100644
index 0000000..51933d6
--- /dev/null
+++ b/xos/tosca/samples/vtn-service-chain.yaml
@@ -0,0 +1,157 @@
+tosca_definitions_version: tosca_simple_yaml_1_0
+
+description: Two services "service_one" and "service_two" with a tenancy relationship.
+
+imports:
+   - custom_types/xos.yaml
+
+topology_template:
+  node_templates:
+
+    Private-Indirect:
+      type: tosca.nodes.NetworkTemplate
+      properties:
+          access: indirect
+
+    management:
+      type: tosca.nodes.network.Network.XOS
+      properties:
+          no-create: true
+          no-delete: true
+          no-update: true
+
+    mysite:
+      type: tosca.nodes.Site
+
+    trusty-server-multi-nic:
+      type: tosca.nodes.Image
+
+    service_vsg:
+      type: tosca.nodes.VSGService
+      requirements:
+          - one_tenant:
+              node: service_one
+              relationship: tosca.relationships.TenantOfService
+      properties:
+          no-create: true
+          no-delete: true
+
+    service_one:
+      type: tosca.nodes.Service
+      requirements:
+          - two_tenant:
+              node: service_two
+              relationship: tosca.relationships.TenantOfService
+      properties:
+          kind: one
+
+    service_two:
+      type: tosca.nodes.Service
+      properties:
+          kind: two
+
+    mysite_one:
+      type: tosca.nodes.Slice
+      properties:
+          network: noauto
+      requirements:
+          - service:
+              node: service_one
+              relationship: tosca.relationships.MemberOfService
+          - site:
+              node: mysite
+              relationship: tosca.relationships.MemberOfSite
+          - management:
+              node: management
+              relationship: tosca.relationships.ConnectsToNetwork
+
+    mysite_two:
+      type: tosca.nodes.Slice
+      properties:
+          network: noauto
+      requirements:
+          - service:
+              node: service_two
+              relationship: tosca.relationships.MemberOfService
+          - site:
+              node: mysite
+              relationship: tosca.relationships.MemberOfSite
+          - management:
+              node: management
+              relationship: tosca.relationships.ConnectsToNetwork
+
+    one_access:
+      type: tosca.nodes.network.Network
+      properties:
+          ip_version: 4
+      requirements:
+          - network_template:
+              node: Private-Indirect
+              relationship: tosca.relationships.UsesNetworkTemplate
+          - owner:
+              node: mysite_one
+              relationship: tosca.relationships.MemberOfSlice
+          - connection:
+              node: mysite_one
+              relationship: tosca.relationships.ConnectsToSlice
+
+    two_access:
+      type: tosca.nodes.network.Network
+      properties:
+          ip_version: 4
+      requirements:
+          - network_template:
+              node: Private-Indirect
+              relationship: tosca.relationships.UsesNetworkTemplate
+          - owner:
+              node: mysite_two
+              relationship: tosca.relationships.MemberOfSlice
+          - connection:
+              node: mysite_two
+              relationship: tosca.relationships.ConnectsToSlice
+
+    # Virtual machines
+    one_instance:
+      type: tosca.nodes.Compute
+      capabilities:
+        # Host container properties
+        host:
+         properties:
+           num_cpus: 1
+           disk_size: 10 GB
+           mem_size: 4 MB
+        # Guest Operating System properties
+        os:
+          properties:
+            # host Operating System image properties
+            architecture: x86_64
+            type: linux
+            distribution: Ubuntu
+            version: 14.10
+      requirements:
+          - slice:
+                node: mysite_one
+                relationship: tosca.relationships.MemberOfSlice
+
+    # Virtual machines
+    two_instance:
+      type: tosca.nodes.Compute
+      capabilities:
+        # Host container properties
+        host:
+         properties:
+           num_cpus: 1
+           disk_size: 10 GB
+           mem_size: 4 MB
+        # Guest Operating System properties
+        os:
+          properties:
+            # host Operating System image properties
+            architecture: x86_64
+            type: linux
+            distribution: Ubuntu
+            version: 14.10
+      requirements:
+          - slice:
+                node: mysite_two
+                relationship: tosca.relationships.MemberOfSlice