1. A machine implemented method of creating a firewall rule data store for a firewall enforcing device, the method comprising: from a controller, receiving a plurality of firewall rules that includes a first set of firewall rules for enforcing on packets of a first set of data end nodes connected to the firewall enforcing device and a second set of firewall rules for enforcing on packets of a second set of data end nodes not connected to the firewall enforcing device; for the first set of data end nodes, using the first set of firewall rules to create at least a first firewall data store; upon connection of a data end node from the second set of data end nodes, using the second set of firewall rules to create a second firewall data store for the newly connected data end node; and enforcing firewall rules for the connected data end nodes by using the rules in their respective firewall data stores to determine whether packets for data end nodes should be forwarded.