A computer-implemented method for dynamically updating the configuration of a network device controlling network traffic, when a change to a set of sources and destinations of the network traffic is detected, comprising: creating a dynamic object on a controller to hold as value a set of network addresses representing sources and destinations of network traffic, wherein creating comprises specifying a query and associating the query with a data source of one or more data sources and with the dynamic object, wherein the query is configured to obtain from the data source a result that includes the set of network addresses representing sources and destinations that is relevant for configuring the network device, and wherein each of the one or more data sources is a server, a database, a network device, or any other computing device providing information about sources and destinations of network traffic; associating, by the controller, a configuration of a network device with the dynamic object, wherein a membership of said dynamic object can change over time as sources and destinations of network traffic are added, removed or migrated in a network; communicating, by the controller, with the one or more data sources to monitor automatically the one or more data sources for a change in said membership of said dynamic object by re-applying the query to the data source periodically or when the data source indicates that new information about sources and destinations of network traffic is available; and updating automatically, by the controller, said configuration of said network device to reflect said membership of said dynamic object when said membership of said dynamic object changes by communicating with the network device and issuing a set of commands to reconfigure the network device. creating a dynamic object on a controller to hold as value a set of network addresses representing sources and destinations of network traffic, wherein creating comprises specifying a query and associating the query with a data source of one or more data sources and with the dynamic object, wherein the query is configured to obtain from the data source a result that includes the set of network addresses representing sources and destinations that is relevant for configuring the network device, and wherein each of the one or more data sources is a server, a database, a network device, or any other computing device providing information about sources and destinations of network traffic; associating, by the controller, a configuration of a network device with the dynamic object, wherein a membership of said dynamic object can change over time as sources and destinations of network traffic are added, removed or migrated in a network; communicating, by the controller, with the one or more data sources to monitor automatically the one or more data sources for a change in said membership of said dynamic object by re-applying the query to the data source periodically or when the data source indicates that new information about sources and destinations of network traffic is available; and updating automatically, by the controller, said configuration of said network device to reflect said membership of said dynamic object when said membership of said dynamic object changes by communicating with the network device and issuing a set of commands to reconfigure the network device.