A value-added service deployment method, comprising: receiving (201, 303), by a network device, a first registration request message sent by a value-added service device, wherein the first registration request message comprises an IP address of the value-added service device; acquiring (202, 305), by the network device, according to the first registration request message, virtual system information of a virtual system generated by the value-added service device for the network device; allocating (203, 306), by the network device, a virtual slot and a slot number to the virtual system, wherein the network device comprises physical slots for physical service boards, and allocates as the virtual slot number a higher number than the highest physical slot number; establishing a bidirectional extended Generic Routing Encapsulation, GRE, tunnel between the network device and the virtual system, wherein an extended GRE message comprises an added fabric header between the GRE header and a payload, the fabric header comprising a SlotID field; sending (204, 307), by the network device, the slot number to the virtual system according to the virtual system information; and managing the virtual system as a value-added service board of the network device; wherein the managing the virtual system as a value-added service board of the network device comprises the network device communicating, through the established bidirectional extended GRE tunnel, with the virtual system; wherein the communicating through the bidirectional extended GRE tunnel comprises the SlotID field having the value "0" when the network device is the sender; wherein the value-added service device comprises a firewall, a load balancer, an intrusion prevention system, a data loss prevention device, an anti-virus device, or an application acceleration device. receiving (201, 303), by a network device, a first registration request message sent by a value-added service device, wherein the first registration request message comprises an IP address of the value-added service device; acquiring (202, 305), by the network device, according to the first registration request message, virtual system information of a virtual system generated by the value-added service device for the network device; allocating (203, 306), by the network device, a virtual slot and a slot number to the virtual system, wherein the network device comprises physical slots for physical service boards, and allocates as the virtual slot number a higher number than the highest physical slot number; establishing a bidirectional extended Generic Routing Encapsulation, GRE, tunnel between the network device and the virtual system, wherein an extended GRE message comprises an added fabric header between the GRE header and a payload, the fabric header comprising a SlotID field; sending (204, 307), by the network device, the slot number to the virtual system according to the virtual system information; and managing the virtual system as a value-added service board of the network device; wherein the managing the virtual system as a value-added service board of the network device comprises the network device communicating, through the established bidirectional extended GRE tunnel, with the virtual system; wherein the communicating through the bidirectional extended GRE tunnel comprises the SlotID field having the value "0" when the network device is the sender; wherein the value-added service device comprises a firewall, a load balancer, an intrusion prevention system, a data loss prevention device, an anti-virus device, or an application acceleration device.