Size the WAN circuit a remote-access or site-to-site VPN needs once encryption and encapsulation overhead is added.
Concurrency turns a user population into a simultaneous load, and the ratio (payload + header) ÷ payload converts clear-text demand into ciphertext on the wire. Small packets pay the fixed ESP header far more often, so voice-heavy traffic inflates more than bulk file transfer. VPN circuits are billed on the encrypted rate, not the payload rate, so sizing on application throughput alone under-provisions the link by 8–15% and shows up as tunnel drops at peak.
VPN Bandwidth
tunnel Mbps = concurrent users × per-user rate × (packet size + encapsulation bytes) ÷ packet size.
tunnel Mbps = concurrent users × per-user rate × (packet size + encapsulation bytes) ÷ packet size. Concurrency turns a user population into a simultaneous load, and the ratio (payload + header) ÷ payload converts clear-text demand into ciphertext on the wire. Small packets pay the fixed ESP header far more often, so voice-heavy traffic inflates more than bulk file transfer.
VPN circuits are billed on the encrypted rate, not the payload rate, so sizing on application throughput alone under-provisions the link by 8–15% and shows up as tunnel drops at peak.
This calculator takes 5 inputs: Remote users, Per-user throughput, Concurrent users, Average packet size, VPN encapsulation. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.