Size a VPN concentrator against aggregate encrypted bandwidth, tunnel count limits and the gateway count you need.
A VPN gateway hits one of two ceilings: encrypted bits per second through the crypto engine, or the number of security associations it can hold. Size against both, target 70% of each so a failover or growth spurt does not tip you over, and take the larger gateway count. Remote-access designs almost always run out of tunnels before bandwidth while site-to-site designs run out of bandwidth first, so sizing on only one number produces the wrong platform.
VPN Capacity
aggregate = peers × bandwidth per peer; gateways = ceil(max(aggregate ÷ 70% of crypto throughput, tunnels ÷ 70% of tunnel limit)).
aggregate = peers × bandwidth per peer; gateways = ceil(max(aggregate ÷ 70% of crypto throughput, tunnels ÷ 70% of tunnel limit)). A VPN gateway hits one of two ceilings: encrypted bits per second through the crypto engine, or the number of security associations it can hold. Size against both, target 70% of each so a failover or growth spurt does not tip you over, and take the larger gateway count.
Remote-access designs almost always run out of tunnels before bandwidth while site-to-site designs run out of bandwidth first, so sizing on only one number produces the wrong platform.
This calculator takes 5 inputs: Concurrent VPN users or sites, Average bandwidth per peer, Gateway IPsec/crypto throughput, Maximum tunnels per gateway, Tunnels per peer. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Dramatically. Full-tunnel forces all internet traffic through the gateway, often tripling or quadrupling per-user bandwidth; split tunnelling carries only corporate destinations. Model both — the pandemic-era capacity crunches were almost entirely full-tunnel policies applied to newly remote workforces.