Current VCLs does not support shielding:

Fastly's shielding service feature allows you to designate a specific Point of Presence (POP) as a shield node to your origins. Once designated, all requests to your origin will go through that datacenter, increasing the chances of getting a HIT for a given resource.

1. edge PoP receives the request and holds it, and sends a hash request to shield
2. Shield PoP sends hash request to origin ( unless it has it already in cache and can return a hit )
3. origin receives the hash request and sends back a reply to shield
4. shield will forward the response from origin to edge more or less as-is
5. edge PoP receives the hash response, copies the hash header to the client’s original request for /foo and restarts that request.
6. shield receives the request for /foo which includes the hash header, forwards it to origin
7. edge PoP receives the response from shield, then perform esi processing