1. A method of replicating firewall rules for a tenant having a plurality of data compute nodes (DCNs) across a plurality of data centers, each data center comprising a set of hosts and a network manager, each host configured to host one or more DCNs, the method comprising: receiving a first set of firewall rules referencing first and second sets of objects, each of the first set of objects comprising an identifier identifiable by a first network manager in a first data center, each of the second set of objects comprising an identifier not identifiable by the first network manager; translating the first set of objects by searching a local inventory of objects, the local inventory of objects mapping the identifiers of the first set of objects into a first set of globally recognized identifiers that are identifiable by the network managers of the plurality of data centers; translating the second set of objects by searching a global inventory of objects, the global inventory of objects mapping the identifiers of the second set of objects into a second set of globally recognized identifiers identifiable by the network managers of the plurality of data centers; translating the first set of firewall rules into a second set of global firewall rules using the first and second sets of globally recognized identifiers; and replicating the second set of global firewall rules to the network managers across the plurality of data centers, wherein the first and second sets of identifiers comprise at least one of a static Internet protocol (IP) address and a media access control (MAC) address, wherein each global firewall rule includes (i) a set of n-tuples for comparing with a set of attributes of a packet to determine whether a firewall rule is applicable to the packet, and (ii) an action identifier that specifies the action to perform on the packet when the firewall rule is applicable to the packet.