1. A method comprising: at a virtual network device, defining and storing information representing a first security management zone for a virtual firewall policy comprising one or more common attributes of applications associated with the first security zone; defining and storing information representing a first firewall rule for the first security zone comprising first conditions for matching common attributes of applications associated with the first security zone, and an action to be performed on application traffic; receiving parameters associated with the application traffic; determining if the application traffic parameters satisfy the first conditions of the first firewall rule; and in response to determining that the first conditions are satisfied, performing the action.