1. A method for use by a security gateway in a network topology in which the security gateway interfaces one or more virtual machines running on one or more network devices to a network, the method comprising: receiving, by the security gateway, information from a virtual machine after the virtual machine has been moved from a first physical location in a network to a second physical location in the network, the information identifying the virtual machine as one previously assigned to a security boundary; determining, by the security gateway, that access to the virtual machine at the first physical location was permitted by the security gateway; assigning the virtual machine at the second physical location to the security boundary; and applying, by the security gateway, a security policy associated with the security boundary to communications between the network and the virtual machine at the second physical location.