Firewall Configuration Versioning

A method for managing firewall protection in a datacenter comprising a plurality of computing devices capable of enforcing firewall protection based on a firewall configuration of the data center, the method comprising:

• receiving updates to entities of the firewall configuration by making changes to each updated firewall configuration entity;
• associating each updated firewall configuration entity with a version number that corresponds to a time instant that the firewall configuration entity is updated;
• generating a local-level firewall configuration to be enforced at a particular computing device and associating the local-level firewall configuration with a particular version number that is based on the version numbers associated with the firewall configuration entities at a time instant that the local-level firewall configuration is generated;
• and
• monitoring for obsolescence of the local-level firewall configuration by comparing the particular version number with the version numbers associated with the firewall configuration entities after the time instant that the local-level firewall configuration is generated.

A non-transitory machine readable medium storing a program which when executed by at least one processing unit manages firewall protection in a datacenter comprising a plurality of host machines that each hosts a set of data compute nodes, the program comprising sets of instructions for:

• maintaining a firewall configuration for the plurality of host machines at a network manager of the data center, the firewall configuration comprising a plurality of firewall rules that are to be enforced at the plurality of host machines;
• aggregating a first plurality of updates to the firewall configuration into a first aggregated update and associating the first aggregated update with a first version number;
• distributing a first host-level firewall configuration update to a first host machine based on the first aggregated update and associating the first host machine with the first version number;
• and
• aggregating a second plurality of updates to the firewall configuration into a second aggregated update and associating the second aggregated update with a second version number.