A method for enforcing, on a logical network running on a software-defined datacenter, a unified global policy having a plurality of rules to two or more isolated computing systems (130, 131), the method comprising: at a central controller, transmitting, to at least a first computing system and a second computing system, the plurality of rules of the unified global policy, wherein the first computing system includes a first set of virtual machines assigned a first Internet protocol 'IP' address block and the second computing system includes a second set of virtual machines assigned a second IP address block, the first IP address block having an address space which at least partially overlaps the second IP address block; and at a first virtual machine of the first computing system: receiving the plurality of rules of the unified global policy; identifying a packet to be transmitted from the first virtual machine to a destination virtual machine; identifying a source logical port identifier of the first virtual machine and a destination logical port identifier of the destination virtual machine; in accordance with a determination, based on the source logical port identifier and the destination logical port identifier, that the packet is prohibited by a first rule of the plurality of rules from being transmitted from the first virtual machine to the destination virtual machine, forgoing transmitting the packet; and in accordance with a determination, based on the source logical port identifier and the destination logical port identifier, that the packet is not prohibited by the plurality of rules, including the first rule, from being transmitted from the first virtual machine to the destination virtual machine, transmitting a communication using the destination logical port identifier, wherein the communication includes the packet. at a central controller, transmitting, to at least a first computing system and a second computing system, the plurality of rules of the unified global policy, wherein the first computing system includes a first set of virtual machines assigned a first Internet protocol 'IP' address block and the second computing system includes a second set of virtual machines assigned a second IP address block, the first IP address block having an address space which at least partially overlaps the second IP address block; and at a first virtual machine of the first computing system: receiving the plurality of rules of the unified global policy; identifying a packet to be transmitted from the first virtual machine to a destination virtual machine; identifying a source logical port identifier of the first virtual machine and a destination logical port identifier of the destination virtual machine; in accordance with a determination, based on the source logical port identifier and the destination logical port identifier, that the packet is prohibited by a first rule of the plurality of rules from being transmitted from the first virtual machine to the destination virtual machine, forgoing transmitting the packet; and in accordance with a determination, based on the source logical port identifier and the destination logical port identifier, that the packet is not prohibited by the plurality of rules, including the first rule, from being transmitted from the first virtual machine to the destination virtual machine, transmitting a communication using the destination logical port identifier, wherein the communication includes the packet. receiving the plurality of rules of the unified global policy; identifying a packet to be transmitted from the first virtual machine to a destination virtual machine; identifying a source logical port identifier of the first virtual machine and a destination logical port identifier of the destination virtual machine; in accordance with a determination, based on the source logical port identifier and the destination logical port identifier, that the packet is prohibited by a first rule of the plurality of rules from being transmitted from the first virtual machine to the destination virtual machine, forgoing transmitting the packet; and in accordance with a determination, based on the source logical port identifier and the destination logical port identifier, that the packet is not prohibited by the plurality of rules, including the first rule, from being transmitted from the first virtual machine to the destination virtual machine, transmitting a communication using the destination logical port identifier, wherein the communication includes the packet.