1. A computing method, comprising: specifying a virtual computer system comprising a plurality of compute nodes, which produces data packets having respective source addresses; implementing the virtual computer system on a physical computer system that includes at least one physical packet switching element; defining a plurality of Virtual Input-Output Connections (VIOCs) in the virtual computer system and uniquely associating each of the VIOCs with a unique set of at least one address of a respective compute node; receiving, at a configuration station, a definition of a policy specifying an operation to be performed on packets of a specific VIOC; translating, automatically by a processor, the received policy definition with regard to the specific VIOC into a configuration dependent on the at least one address of the respective compute node of the specific VIOC; configuring, automatically by the processor, the at least one physical packet switching element with the configuration; detecting, automatically by the processor, a change in one of the physical computer system and the virtual computer system, the change resulting in a change in the respective compute node corresponding to the specific VIOC; updating the translation of the received policy definition, automatically by the processor, responsively to the change in the respective compute node corresponding to the specific VIOC; and automatically re-configuring the at least one physical packet switching element by the processor, responsively to the updated translation, so as to cause the at least one physical packet switching element to continue enforcing the policy on the respective compute node corresponding to the specific VIOC following the detected change.