A method, system, and medium are provided for locating an optimal security gateway. A default gateway receives a request to access a macrocell. The default security gateway obtains a current location for each macrocell in response to a security gateway discovery function. Based on the response, routes to a best security gateway for each macrocell are determined. A best security gateway is identified based on factors that include the distance from a picocell connected to the default security gateway having backhaul traffic to offload to the appropriate macrocells connected to the best security gateway.