Translation Cache for Firewall Configuration

A method for distributing firewall configuration in a datacenter comprising a plurality of host machines, the method comprising:

• examining a firewall rule in the firewall configuration that uses a high-level construct to reference a set of low-level constructs;
• translating the high-level construct to a low-level construct and storing the result of said translation into a translation cache as an entry in the cache;
• associating the cache entry with a particular version number that is based on a time instant at which the firewall configuration was updated;
• and
• upon receiving a query for the high-level construct, providing the result of the translation of the high-level construct stored in the translation cache when the received query is associated with a minimum required version number that is not newer than the particular version number associated with the cache entry.

A non-transitory machine readable medium storing a program which when executed by at least one processing unit distributes firewall configuration in a datacenter comprising a plurality of host machines, the method comprising:

• retrieving a rule in the firewall configuration for distribution to the plurality of host machines, the firewall rule associated with a minimum required version number;
• identifying a high-level construct in the firewall rule;
• querying a translation cache for the identified high-level construct, the translation cache storing previous translation results for different high-level constructs, each stored translation result associated with a version number;
• and
• when the translation cache has a stored previous translation result for the identified high-level construct that is associated with a version number that is equal to or newer than the minimum required version number, using the previous translation result stored in the cache to translate the identified high-level construct to a low-level construct.