1. A method of operating a firewall cluster, comprising: receiving a connection request in a first node of a firewall cluster having three or more nodes, the first node performing a firewall task; processing the connection request to establish a connection; determining user data associated with the established connection; sharing the user data with at least another node in the firewall cluster; and reassigning the first node, comprising: changing the first node from performing the firewall task to performing an intrusion protection task; redirecting the established connection from the first node to the at least another node; and reassigning the first node to perform the intrusion protection task, wherein reassigning the first node is in response to failure of a second node configured to perform the intrusion protection task.