What is a Versa Service Header?

A Versa Service Header (VSH) is a proprietary UDP-based encapsulation header that a standby VOS device adds to packets it forwards to the active device during data punting in an interchassis high-availability deployment – the internal mechanism that lets a standby appliance relay traffic to its active peer instead of dropping it.

Key takeaways

• VSH is a proprietary UDP encapsulation used only in interchassis HA.
• A standby VOS device adds it when punting data to the active device.
• It carries forwarded packets between HA peers, not general client traffic.
• VSH operates automatically – it isn’t a setting administrators configure.
• The mechanism is internal to Versa’s HA data plane, not a public standard.

On this page: Why it matters · How it works · How VSH works · VSH & Versa · FAQ

Why does VSH matter?

Interchassis high availability pairs two separate VOS chassis so that if the active device fails, its standby peer can take over without an outage. But not every packet that reaches the standby device belongs to it – some sessions are still owned and serviced by the active peer. Without a way to relay that traffic, the standby would have to drop it, breaking the very session HA exists to protect.

VSH solves that problem. It’s the encapsulation format a standby device uses to wrap and forward, or “punt,” those packets to the active device, so the session keeps working even though it briefly touches the standby chassis first. This punting mechanism is part of what makes interchassis HA transparent: end clients and downstream networks never see it happen, and traffic keeps flowing through the pair as if only one device existed.

What is a Versa Service Header?

VSH is a header Versa defines for its own interchassis HA data plane – it is proprietary, not a public or IETF-standard protocol. In its role, a VOS device acting as standby wraps a UDP packet carrying the VSH header around traffic it needs to punt, then sends it to its active peer over the HA interconnect – from its port 3002 to port 3002 on the active service node. The active device receives it, strips the VSH encapsulation, and processes the original packet as though it had arrived there directly.

Because the mechanism operates at the UDP layer strictly between the two HA peers, it stays internal to the appliance pair. Client traffic, routing protocols, and downstream network elements never interact with a VSH header directly; it exists only for the brief internal hop between standby and active during data punting.

How VSH works

The scenario VSH exists for is data punting: a packet lands on the standby device’s interface, but the session or service it belongs to is currently owned by the active device. Rather than process or drop that packet locally, the standby encapsulates it with a VSH header and forwards it across the HA interconnect to the active device, which unwraps and handles it normally, as the owning device.

This differs from the control-plane exchanges that keep the two HA peers’ state synchronized. VSH is specifically a data-plane relay format – it carries user traffic that needs to reach the device actually responsible for it, rather than configuration, state-sync, or heartbeat information passed between the pair.

VSH & Versa

VSH is scoped to interchassis HA specifically – pairing two physically separate VOS appliances, as distinct from intrachassis HA within a single chassis. It is an implementation detail of how the standby and active devices cooperate, not a setting exposed for administrators to tune directly: interchassis HA itself is what gets configured, through Versa’s device and HA templates, and VSH operates automatically underneath that configuration whenever punting is required.

Because VSH is proprietary to Versa’s HA architecture rather than an industry standard, information about it lives in Versa’s own product documentation and training rather than external standards bodies.

Frequently asked questions

What does VSH stand for?

VSH stands for Versa Service Header – the proprietary UDP-based encapsulation a standby VOS device uses to forward, or punt, packets to its active peer during interchassis high-availability operation, rather than processing or simply dropping them itself at the standby chassis.

When does a VOS device add a VSH header?

A standby VOS device adds a VSH header during data punting: when it receives a packet belonging to a session or service currently owned by the active device in an interchassis HA pair, and needs to relay that packet instead of handling it locally.

What protocol does VSH run over?

VSH is UDP-based. The standby device encapsulates the punted packet inside a UDP packet carrying the VSH header, then sends it to the active device over the interchassis HA interconnect, where the active device strips the encapsulation and processes the original packet.

Is VSH something administrators configure directly?

No. VSH is an internal mechanism the standby device applies automatically once interchassis HA is deployed; it isn’t a setting exposed anywhere in device templates. Administrators configure interchassis HA itself, and VSH quietly operates underneath that configuration whenever data punting occurs between the two peers.

Does VSH affect traffic outside the HA pair?

No. VSH encapsulation exists only between the standby and active devices in an interchassis HA pair, and is stripped before the active device forwards the original packet onward. Clients, routing peers, and downstream networks never see a VSH header on the wire.

More on VSH

If you want to learn more, these are sources we trust.

Related terms

If you’re reading about VSH, these are worth looking at next.