1. A method of maintaining a plurality of firewalls on a plurality of host nodes, each host node for running at least one virtual machine, the method comprising: for at least a first host node, a) maintaining a plurality of sets of policies for a plurality of virtual machines running on the first host node, and b) upon detecting that a particular virtual machine has been moved from the first host node to a second host node: i) removing a set of policies associated with the particular virtual machine from a firewall of the first host node; and ii) supplying the set of policies to a firewall of the second host node.