Network policy migration in a federated hybrid cloud

A non-transitory computer readable medium comprising instructions, which when executed in a computer system, causes the computer system to carry out a method of migrating a firewall policy between a first virtual data center and a second virtual data center, the method comprising:

• establishing a communication link between a first firewall server in the first virtual data center and a second firewall server in the second virtual data center over a network, the first firewall server having a first firewall defined by policies applied to groups of objects in the first virtual data center;
• obtaining, at the first firewall server, an inventory of objects in the second virtual data center from the second firewall server;
• determining firewall rule tuples by mapping the policies of the first firewall to groups of objects in the inventory of the second virtual data center;
• sending the firewall rule tuples from the first firewall server to enforcement points in the second virtual data center;
• and
• sending the first firewall from the first firewall server to the second firewall server.

A computing system, comprising:

• a first data center having a first firewall server and a first plurality of virtual machines;
• a second data center having a second firewall server and a second plurality of virtual machines migrated from the first data center, wherein the first firewall server is configured to:
• establish a communication link with the second firewall server over a network, the first firewall server having a first firewall defined by policies applied to groups of objects in the first data center;
• obtain an inventory of objects in the second data center from the second firewall server;
• determine firewall rule tuples by mapping the policies of the first firewall to groups of objects in the inventory of the second data center;
• send the firewall rule tuples from the first firewall server to enforcement points in the second data center;
• and
• send the first firewall from the first firewall server to the second firewall server.