VPP dataplane · immutable OS · one CLI
The lion-hearted
network appliance
SiHA is a firewall, router and load-balancer in one box — a kernel-bypass VPP dataplane steered by a declarative control plane, on an immutable, self-upgrading OS.
One box, three roles
Everything on the edge, converged
Firewall
Stateful ACLs, NAT44 (static, dynamic, twice-NAT). Rules compile straight into the VPP dataplane.
Router
VRFs, static routes and embedded BGP (per-tenant, in-VRF). Learned routes land in the VPP FIB.
Load balancer
NAT-LB VIPs with health-checked backends and BGP active-active anycast across nodes.
Where it sits
Traffic flows through SiHA
VPP kernel-bypass dataplane
DPDK poll-mode drivers bind the NICs. Packets never touch the Linux kernel — forwarding runs at line rate.
Immutable, A/B OS
One signed squashfs image, SecureBoot-enforced. Upgrades are atomic and health-gated, with auto-rollback.
Declarative control plane
Every feature is a resource you apply. The control plane reconciles it into the dataplane and keeps it converged.
Under the hood
The life of a packet
A frame arrives on a DPDK-bound NIC and runs a graph of VPP nodes — no context switches, no kernel networking stack.
Managed by one CLI
Declare it. Apply it. Done.
No SSH on the appliance, no config files to hand-edit. You describe interfaces, ACLs,
NAT, VIPs and routes as resources; sihactl applies them over mTLS and the
control plane reconciles the dataplane.
$ sihactl get interfaces
NAMESPACE ID KIND OPERSTATE ADDRESSES
link ext pmd up 203.0.113.1/24
link int pmd up 10.0.1.1/24
$ sihactl config apply -f siha-config/
applied 12 resources
$ sihactl health
HEALTHY · vpp up · 4 interfaces · bgp established
Redundant by design
Scale out, fail over
Run a pair or a fleet. VRRP shares a virtual gateway; BGP active-active spreads a VIP across nodes as anycast. A node can be drained, upgraded and rejoined with no flow drop.