VPN Capacity Calculator
Size a VPN concentrator against aggregate encrypted bandwidth, tunnel count limits and the gateway count you need.
Inputs
Redundant hub pairs or per-VRF tunnels multiply this.
Aggregate Encrypted Throughput
3.750Gbps
Crypto Engine Utilisation
37.5%
Tunnels Required
2,500
Tunnel Table Utilisation
25.0%
Gateways Required (70% target)
1
Binding Constraint
Crypto throughput is the limit
Step by step
Values used
Concurrent VPN users or sites = 2,500 peers; Average bandwidth per peer = 1.50 Mbps; Gateway IPsec/crypto throughput = 10 Gbps; Maximum tunnels per gateway = 10,000 tunnels; Tunnels per peer = 1 tunnels
VPN Capacity
aggregate = peers × bandwidth per peer; gateways = ceil(max(aggregate ÷ 70% of crypto throughput, tunnels ÷ 70% of tunnel limit)).
Aggregate Encrypted Throughput
= 3.750 Gbps
Crypto Engine Utilisation
= 37.5
Tunnels Required
= 2,500
Tunnel Table Utilisation
= 25.0
Gateways Required (70% target)
= 1
Binding Constraint
= Crypto throughput is the limit
How it works
A VPN gateway hits one of two ceilings: encrypted bits per second through the crypto engine, or the number of security associations it can hold. Size against both, target 70% of each so a failover or growth spurt does not tip you over, and take the larger gateway count. Remote-access designs almost always run out of tunnels before bandwidth while site-to-site designs run out of bandwidth first, so sizing on only one number produces the wrong platform.
Formula
VPN Capacity
aggregate = peers × bandwidth per peer; gateways = ceil(max(aggregate ÷ 70% of crypto throughput, tunnels ÷ 70% of tunnel limit)).
- crypto throughput
- Encrypted forwarding rate of the gateway's crypto engine
- tunnel limit
- Maximum simultaneous security associations the platform holds
Frequently Asked Questions
How is VPN Capacity calculated?
aggregate = peers × bandwidth per peer; gateways = ceil(max(aggregate ÷ 70% of crypto throughput, tunnels ÷ 70% of tunnel limit)). A VPN gateway hits one of two ceilings: encrypted bits per second through the crypto engine, or the number of security associations it can hold. Size against both, target 70% of each so a failover or growth spurt does not tip you over, and take the larger gateway count.
Why does VPN Capacity matter?
Remote-access designs almost always run out of tunnels before bandwidth while site-to-site designs run out of bandwidth first, so sizing on only one number produces the wrong platform.
What values do I need to enter?
This calculator takes 5 inputs: Concurrent VPN users or sites, Average bandwidth per peer, Gateway IPsec/crypto throughput, Maximum tunnels per gateway, Tunnels per peer. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Does split tunnelling change the sizing?
Dramatically. Full-tunnel forces all internet traffic through the gateway, often tripling or quadrupling per-user bandwidth; split tunnelling carries only corporate destinations. Model both — the pandemic-era capacity crunches were almost entirely full-tunnel policies applied to newly remote workforces.