A method comprising: accessing, with a security management system of a data center , a centralized network controller for a software defined network within the data center to obtain security group information for a virtual firewall of the software defined network, wherein the security group information specifies a cluster of virtual machines of the software defined network that is protected by the virtual firewall that provides network security for traffic flowing between applications executing on the cluster of virtual machines, wherein the security management system is provided by a first entity, wherein the centralized network controller is provided by a second entity, and wherein the centralized network controller configures the security group information in a syntax that conforms to requirements of the virtual firewall; and automatically configuring, with the security management system, a perimeter firewall positioned on the edge of the data center with one or more security policies based on the security group information from the virtual firewall of the software defined network, wherein the perimeter firewall provides network security for traffic flowing between the software defined network and devices external to the data center, wherein automatically configuring the perimeter firewall comprises automatically constructing, by the security management system of the first entity, the one or more security policies using address group information translated from the security group information, wherein the security management system configures the address group information in a syntax that conforms to the requirements of the perimeter firewall. accessing, with a security management system of a data center , a centralized network controller for a software defined network within the data center to obtain security group information for a virtual firewall of the software defined network, wherein the security group information specifies a cluster of virtual machines of the software defined network that is protected by the virtual firewall that provides network security for traffic flowing between applications executing on the cluster of virtual machines, wherein the security management system is provided by a first entity, wherein the centralized network controller is provided by a second entity, and wherein the centralized network controller configures the security group information in a syntax that conforms to requirements of the virtual firewall; and wherein the security management system is provided by a first entity, wherein the centralized network controller is provided by a second entity, and wherein the centralized network controller configures the security group information in a syntax that conforms to requirements of the virtual firewall; and automatically configuring, with the security management system, a perimeter firewall positioned on the edge of the data center with one or more security policies based on the security group information from the virtual firewall of the software defined network, wherein the perimeter firewall provides network security for traffic flowing between the software defined network and devices external to the data center, wherein automatically configuring the perimeter firewall comprises automatically constructing, by the security management system of the first entity, the one or more security policies using address group information translated from the security group information, wherein the security management system configures the address group information in a syntax that conforms to the requirements of the perimeter firewall. <EOS>