1. A method of distributing firewall rules, the method comprising: specifying a firewall rule and an enforcement node identifier that identifies a set of enforcement nodes at which the firewall rule should be enforced by a set of enforcement devices; distributing the specified firewall rule to each enforcing device in the set of enforcement devices, wherein at least a first enforcement device in the set enforces the firewall rule for at least a group of two enforcement nodes; modifying the set of enforcement devices by adding a particular enforcement node to the group of enforcement nodes; and in response to the modification, communicating with the first enforcement device to add the particular enforcement node to the group of enforcement nodes.