A method comprising: maintaining, by a security entity configuration unit , configuration information (121-1) and a set of device type -specific communication definitions (121-2) of one or more first network elements, wherein the set of device type - specific communication definitions comprises usable protocols, allowed packet sizes for traffic flows, and bandwidth characteristics for traffic flows; receiving (2-1, 3-1, 501) in the security entity configuration unit a network management message from a network manager device, the network management message comprising network configuration information of at least a second network element, said network configuration information of the second network element in the network management message comprising at least indication of its type, one or more IP addresses of the second network element, one or more ports to be used with various traffic flows and some information on one or more communication counterparts among the one or more first network elements, wherein a communication counterpart is a network element the second network element is connected to; using (2-3, 2-4, 2-5), by the security entity configuration unit, the set of device type -specific communication definitions to determine one or more network element configurations for the second network element and for the one or more communication counterparts; defining (2-10, 3-8, 505, 507), by the security entity configuration unit, at least a set of traffic rules for each involved security entity connected to the second network element or to any of the one or more communication counterparts using the configuration information of the one or more communication counterparts and the received network configuration information of at least a second network element; and sending (2-13, 2-13', 2-14, 2-14', 3-9, 3-9', 506) the set of traffic rules for an involved security entity from a security entity controller to said involved security entity. maintaining, by a security entity configuration unit , configuration information (121-1) and a set of device type -specific communication definitions (121-2) of one or more first network elements, wherein the set of device type - specific communication definitions comprises usable protocols, allowed packet sizes for traffic flows, and bandwidth characteristics for traffic flows; receiving (2-1, 3-1, 501) in the security entity configuration unit a network management message from a network manager device, the network management message comprising network configuration information of at least a second network element, said network configuration information of the second network element in the network management message comprising at least indication of its type, one or more IP addresses of the second network element, one or more ports to be used with various traffic flows and some information on one or more communication counterparts among the one or more first network elements, wherein a communication counterpart is a network element the second network element is connected to; using (2-3, 2-4, 2-5), by the security entity configuration unit, the set of device type -specific communication definitions to determine one or more network element configurations for the second network element and for the one or more communication counterparts; defining (2-10, 3-8, 505, 507), by the security entity configuration unit, at least a set of traffic rules for each involved security entity connected to the second network element or to any of the one or more communication counterparts using the configuration information of the one or more communication counterparts and the received network configuration information of at least a second network element; and sending (2-13, 2-13', 2-14, 2-14', 3-9, 3-9', 506) the set of traffic rules for an involved security entity from a security entity controller to said involved security entity. <EOS>