A method for configuring a logical firewall in a hosting system, the method comprising: receiving a specification of a topology of a logical network , the logical network comprising (i) a set of logical forwarding elements (120, 125, 130; 220, 225, 230) that connect a set of end machines (615-618) hosted on a plurality of nodes in the hosting system, and (ii) a logical firewall that logically connects to at least one of the logical forwarding elements (120, 125, 130; 220, 225, 230) to perform firewall processing for packets sent to and from the end machines (615-618), receiving a firewall configuration specifying packet processing rules for the logical firewall ; identifying a plurality of the nodes on which the set of end machines (615-618) reside as nodes on which to implement the set of logical forwarding elements (120, 125, 130; 220, 225, 230) and the logical firewall ; and propagating, to each of the identified nodes , (i) forwarding data defining the logical forwarding elements (120, 125, 130; 220, 225, 230) and (ii) the configuration of the logical firewall , in order to implement both the logical forwarding elements (120, 125, 130; 220, 225, 230) and the firewall configuration on the identified nodes on which the end machines (615-618) of the logical network reside, wherein the set of logical forwarding elements (120, 125, 130; 220, 225, 230) are implemented by managed forwarding elements on each of the identified nodes and the packet processing rules of the logical firewall are implemented by firewall elements on each of the identified nodes such that the managed forwarding elements and firewall elements on the plurality of nodes implement the logical network in a distributed manner. receiving a specification of a topology of a logical network , the logical network comprising (i) a set of logical forwarding elements (120, 125, 130; 220, 225, 230) that connect a set of end machines (615-618) hosted on a plurality of nodes in the hosting system, and (ii) a logical firewall that logically connects to at least one of the logical forwarding elements (120, 125, 130; 220, 225, 230) to perform firewall processing for packets sent to and from the end machines (615-618), receiving a firewall configuration specifying packet processing rules for the logical firewall ; identifying a plurality of the nodes on which the set of end machines (615-618) reside as nodes on which to implement the set of logical forwarding elements (120, 125, 130; 220, 225, 230) and the logical firewall ; and propagating, to each of the identified nodes , (i) forwarding data defining the logical forwarding elements (120, 125, 130; 220, 225, 230) and (ii) the configuration of the logical firewall , in order to implement both the logical forwarding elements (120, 125, 130; 220, 225, 230) and the firewall configuration on the identified nodes on which the end machines (615-618) of the logical network reside, wherein the set of logical forwarding elements (120, 125, 130; 220, 225, 230) are implemented by managed forwarding elements on each of the identified nodes and the packet processing rules of the logical firewall are implemented by firewall elements on each of the identified nodes such that the managed forwarding elements and firewall elements on the plurality of nodes implement the logical network in a distributed manner. <EOS>