Firewall configuration versioning

A non-transitory machine readable medium storing a network manager that when executed by at least one processing unit of a computer in a datacenter manages firewall protection in the datacenter, the datacenter comprising a plurality of host machines that each hosts a set of data compute nodes, the network manager comprising sets of instructions for:

• receiving a plurality of updates to sections of a firewall rule configuration stored in a firewall rule configuration storage of the datacenter, the firewall rule configuration comprising a plurality of firewall rules that are to be enforced at the plurality of host machines, and associating each updated section with a version number;
• using a version number associated with an updated section to identify a host machine in the datacenter that has not received one of the plurality of updates;
• generating a host-level firewall configuration update comprising the updates relevant to the identified host machine and associating the host-level configuration update with a particular version number of the version numbers associated with the relevant updates;
• and
• distributing the host-level firewall configuration update to the identified host machine and associating the identified host machine with the particular version number,
• wherein said identified host machine uses the host-level firewall configuration update to process packets for a data compute node executing on the identified host machine in accordance with firewall actions specified by the host-level firewall configuration update.