A method for network configuration in a multi-tenant network environment, the method comprising: receiving a service profile defining network application requirements for a tenant of the network environment, wherein the service profile comprises at least two end point groups, EPGs (704, 708, 712, 716), and at least one policy contract (702, 706, 710, 714) defining traffic flow constraints between the at least two EPGs (704, 708, 712, 716); mapping the received service profile to a logical network implementation associating a plurality of logical routers (902a, 906a, 910a, 914a), logical switches (804b, 804c, 808b, 812b, 816b) and logical appliances (902b, 902c, 902d, 906b); mapping the logical network implementation to a physical network implementation on available network hardware in the network environment; and generating component configuration information to configure the available network hardware to provide the physical network implementation of the service profile defining the network application requirements; sending the generated component configuration information to the available network hardware for implementing the physical network implementation; wherein mapping the received service profile to the logical network implementation comprises: mapping each EPG (704, 708, 712, 716) to at least one logical subnet associated with a logical switch (804b, 804c, 808b, 812b, 816b); and mapping each policy contract (702, 706, 710, 714) to one or more logical appliances (902b, 902c, 902d, 906b) connected to a logical router (902a, 906a, 910a, 914a). receiving a service profile defining network application requirements for a tenant of the network environment, wherein the service profile comprises at least two end point groups, EPGs (704, 708, 712, 716), and at least one policy contract (702, 706, 710, 714) defining traffic flow constraints between the at least two EPGs (704, 708, 712, 716); mapping the received service profile to a logical network implementation associating a plurality of logical routers (902a, 906a, 910a, 914a), logical switches (804b, 804c, 808b, 812b, 816b) and logical appliances (902b, 902c, 902d, 906b); mapping the logical network implementation to a physical network implementation on available network hardware in the network environment; and generating component configuration information to configure the available network hardware to provide the physical network implementation of the service profile defining the network application requirements; sending the generated component configuration information to the available network hardware for implementing the physical network implementation; wherein mapping the received service profile to the logical network implementation comprises: mapping each EPG (704, 708, 712, 716) to at least one logical subnet associated with a logical switch (804b, 804c, 808b, 812b, 816b); and mapping each policy contract (702, 706, 710, 714) to one or more logical appliances (902b, 902c, 902d, 906b) connected to a logical router (902a, 906a, 910a, 914a). mapping each EPG (704, 708, 712, 716) to at least one logical subnet associated with a logical switch (804b, 804c, 808b, 812b, 816b); and mapping each policy contract (702, 706, 710, 714) to one or more logical appliances (902b, 902c, 902d, 906b) connected to a logical router (902a, 906a, 910a, 914a).