A computer-implemented method for dynamically updating the configuration of a network device (112-118) controlling network traffic, when a change to a set of sources and destinations of the network traffic is detected, comprising: creating a dynamic object on a controller to hold as value a set of network addresses representing sources and destinations of network traffic, wherein creating comprises specifying a query and associating the query with a data source of one or more data sources (102-108) and with the dynamic object, wherein the query is configured to obtain from the data source a result that includes the set of network addresses representing sources and destinations that is relevant for configuring the network device (112-118), and wherein each of the one or more data sources (102-108) is a server, a database, a network device, or any other computing device providing information about sources and destinations of network traffic; associating , by the controller , a configuration of a network device (112-118) with the dynamic object, wherein a membership of said dynamic object can change over time as sources and destinations of network traffic are added, removed or migrated in a network; communicating, by the controller , with the one or more data sources (102-108) to monitor automatically the one or more data sources (102-108) for a change in said membership of said dynamic object by re-applying the query to the data source periodically or when the data source indicates that new information about sources and destinations of network traffic is available; and updating automatically, by the controller , said configuration of said network device (112-118) to reflect said membership of said dynamic object when said membership of said dynamic object changes by communicating with the network device (112-118) and issuing a set of commands to reconfigure the network device (112-118). creating a dynamic object on a controller to hold as value a set of network addresses representing sources and destinations of network traffic, wherein creating comprises specifying a query and associating the query with a data source of one or more data sources (102-108) and with the dynamic object, wherein the query is configured to obtain from the data source a result that includes the set of network addresses representing sources and destinations that is relevant for configuring the network device (112-118), and wherein each of the one or more data sources (102-108) is a server, a database, a network device, or any other computing device providing information about sources and destinations of network traffic; associating , by the controller , a configuration of a network device (112-118) with the dynamic object, wherein a membership of said dynamic object can change over time as sources and destinations of network traffic are added, removed or migrated in a network; communicating, by the controller , with the one or more data sources (102-108) to monitor automatically the one or more data sources (102-108) for a change in said membership of said dynamic object by re-applying the query to the data source periodically or when the data source indicates that new information about sources and destinations of network traffic is available; and updating automatically, by the controller , said configuration of said network device (112-118) to reflect said membership of said dynamic object when said membership of said dynamic object changes by communicating with the network device (112-118) and issuing a set of commands to reconfigure the network device (112-118). <EOS>