1. A method of distributing firewall rules, the method comprising: specifying a firewall rule and a group identifier that identifies a set of enforcement devices at which the firewall rule should be enforced; distributing the specified firewall rule to each enforcing device in the set of enforcement devices of the specified group; modifying the set of enforcement devices identified by the group; and in response to the modification, communicating with at least one enforcement device in the set of enforcement devices to account for the modification.