A method of operating a computer system to authenticate a logical port for a virtual machine in a logical network, the method comprising: by a virtual switch, identifying a logical port authentication request for the virtual machine and transferring the logical port authentication request to a logical port authenticator, wherein the logical port authentication request provides an authentication combination identifying a virtual interface, VIF, of the virtual machine, the logical port, and the virtual switch, V-SW; by the logical port authenticator: receiving the logical port authentication request, determining whether to grant the logical port authentication request based on the provided authentication combination and an authentication database which contains data structures that correlate logical ports with data communication privileges and policies, wherein the privileges indicate allowed VIF/logical port/V-SW combinations and the policies indicate traffic shaping policies for individual VIFs or user applications, and if granted, transferring authorization data for the logical port authentication request to the virtual switch, wherein the authorization data comprises an authenticated VIF/logical port/V-SW combination and a respective traffic shaping policy; and by the virtual switch, transferring user data for the virtual machine when the virtual machine uses the logical port responsive to the authorization data. by a virtual switch, identifying a logical port authentication request for the virtual machine and transferring the logical port authentication request to a logical port authenticator, wherein the logical port authentication request provides an authentication combination identifying a virtual interface, VIF, of the virtual machine, the logical port, and the virtual switch, V-SW; by the logical port authenticator: receiving the logical port authentication request, determining whether to grant the logical port authentication request based on the provided authentication combination and an authentication database which contains data structures that correlate logical ports with data communication privileges and policies, wherein the privileges indicate allowed VIF/logical port/V-SW combinations and the policies indicate traffic shaping policies for individual VIFs or user applications, and if granted, transferring authorization data for the logical port authentication request to the virtual switch, wherein the authorization data comprises an authenticated VIF/logical port/V-SW combination and a respective traffic shaping policy; and receiving the logical port authentication request, determining whether to grant the logical port authentication request based on the provided authentication combination and an authentication database which contains data structures that correlate logical ports with data communication privileges and policies, wherein the privileges indicate allowed VIF/logical port/V-SW combinations and the policies indicate traffic shaping policies for individual VIFs or user applications, and if granted, transferring authorization data for the logical port authentication request to the virtual switch, wherein the authorization data comprises an authenticated VIF/logical port/V-SW combination and a respective traffic shaping policy; and by the virtual switch, transferring user data for the virtual machine when the virtual machine uses the logical port responsive to the authorization data.