Size an SSL VPN gateway for reconnect storms, TLS throughput and session memory, and see which limit binds first.
In steady state an SSL VPN is bound by throughput, because TLS sessions are long-lived and handshakes are rare. The handshake rate only matters during a reconnect storm, when a failover or WAN blip makes every client renegotiate inside a few seconds — so divide the user count by that window, not by the working day. Gateways sized on steady-state numbers routinely collapse during failover, because the asymmetric crypto in thousands of simultaneous handshakes costs orders of magnitude more CPU than the bulk encryption that follows.
SSL VPN Capacity
handshake rate = users ÷ reconnect window; aggregate throughput = users × bandwidth per user; session memory = users × bytes per session.
handshake rate = users ÷ reconnect window; aggregate throughput = users × bandwidth per user; session memory = users × bytes per session. In steady state an SSL VPN is bound by throughput, because TLS sessions are long-lived and handshakes are rare. The handshake rate only matters during a reconnect storm, when a failover or WAN blip makes every client renegotiate inside a few seconds — so divide the user count by that window, not by the working day.
Gateways sized on steady-state numbers routinely collapse during failover, because the asymmetric crypto in thousands of simultaneous handshakes costs orders of magnitude more CPU than the bulk encryption that follows.
This calculator takes 6 inputs: Concurrent remote users, Reconnect-storm window, Gateway TLS handshake capacity, Gateway TLS throughput, Average bandwidth per user, Memory per session. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Yes, substantially. TLS session tickets or 1.3 pre-shared-key resumption skip the expensive asymmetric key exchange, cutting handshake CPU by roughly an order of magnitude. It only helps if the resuming client lands on a gateway that holds the ticket, so a shared ticket key across the cluster is what makes it effective during failover.