VPP dataplane · immutable OS · one CLI
The lion-hearted
network appliance
SiHA is a firewall, router and load-balancer in one box — a kernel-bypass VPP dataplane steered by a declarative control plane, on an immutable, self-upgrading OS.
From rack to routing, in four commands
Simple to operate. Nothing to SSH into.
One box, three roles
Everything on the edge, converged
Firewall
Stateful ACLs, NAT44 (static, dynamic, twice-NAT). Rules compile straight into the VPP dataplane.
Router
VRFs, static routes and embedded BGP (per-tenant, in-VRF). Learned routes land in the VPP FIB.
Load balancer
NAT-LB VIPs with health-checked backends and BGP active-active anycast across nodes.
Where it sits
Traffic flows through SiHA
VPP kernel-bypass dataplane
DPDK poll-mode drivers bind the NICs. Packets never touch the Linux kernel — forwarding runs at line rate.
Immutable, A/B OS
One signed squashfs image, SecureBoot-enforced. Upgrades are atomic and health-gated, with auto-rollback.
Declarative control plane
Every feature is a resource you apply. The control plane reconciles it into the dataplane and keeps it converged.
Under the hood
The life of a packet
A frame arrives on a DPDK-bound NIC and runs a graph of VPP nodes — no context switches, no kernel networking stack.
The read-only admin UI, live
Watch traffic move through it
A client hammers a load-balanced VIP. sihactl web opens the built-in dashboard
in your browser — read-only, over mTLS — and shows it live: packets captured straight off the
VPP dataplane, per-backend LB counters climbing, and the BGP fabric holding steady. No SSH, no
tcpdump on the box.
Managed by one CLI
Declare it. Apply it. Done.
No SSH on the appliance, no config files to hand-edit. You describe interfaces, ACLs,
NAT, VIPs and routes as resources; sihactl applies them over mTLS and the
control plane reconciles the dataplane.
# declare a load-balanced VIP — sihactl applies it,
# the control plane reconciles it into the dataplane
type: NATLBMappings.lb.siha
metadata:
id: web
spec:
vip: 10.40.0.100
port: 80
protocol: TCP
twiceNat: true
backends:
- { address: 10.41.0.10, port: 80 }
- { address: 10.41.0.11, port: 80 }Redundant by design
Scale out, fail over
Run a pair or a fleet. VRRP shares a virtual gateway; BGP active-active spreads a VIP across nodes as anycast. A node can be drained, upgraded and rejoined with no flow drop.