VPN Capacity Calculator
Size a VPN concentrator against aggregate encrypted bandwidth, tunnel count limits and the gateway count you need.
About VPN Capacity Calculator
A VPN gateway hits one of two ceilings: encrypted bits per second through the crypto engine, or the number of security associations it can hold. Size against both, target 70% of each so a failover or growth spurt does not tip you over, and take the larger gateway count. Remote-access designs almost always run out of tunnels before bandwidth while site-to-site designs run out of bandwidth first, so sizing on only one number produces the wrong platform.
Formula
VPN Capacity
aggregate = peers × bandwidth per peer; gateways = ceil(max(aggregate ÷ 70% of crypto throughput, tunnels ÷ 70% of tunnel limit)).
- crypto throughput
- Encrypted forwarding rate of the gateway's crypto engine
- tunnel limit
- Maximum simultaneous security associations the platform holds
Worked example
With the default values below, VPN Capacity Calculator returns Aggregate Encrypted Throughput of 3.750. Change any input above and every figure here is recalculated in your browser.
Inputs used
- Concurrent VPN users or sitesaccepts 1–1,000,000 peers
- 2,500 peers
- Average bandwidth per peeraccepts 0.01–10,000 Mbps
- 1.5 Mbps
- Gateway IPsec/crypto throughputaccepts 0.01–2,000 Gbps
- 10 Gbps
- Maximum tunnels per gatewayaccepts 1–1,000,000 tunnels
- 10,000 tunnels
- Tunnels per peeraccepts 1–16 tunnels
- 1 tunnels
Results
- Aggregate Encrypted Throughput
- 3.750 Gbps
- Crypto Engine Utilisation
- 37.5%
- Tunnels Required
- 2,500
- Tunnel Table Utilisation
- 25.0%
- Gateways Required (70% target)
- 1
- Binding Constraint
- Crypto throughput is the limit
Step by step
- 1Values used
- 2VPN Capacity
- 3Aggregate Encrypted Throughput= 3.750 Gbps
- 4Crypto Engine Utilisation= 37.5
- 5Tunnels Required= 2,500
- 6Tunnel Table Utilisation= 25.0
- 7Gateways Required (70% target)= 1
- 8Binding Constraint= Crypto throughput is the limit
Assumptions and limits
- The result is derived only from the 5 inputs listed above. Anything not among them is not part of the calculation.
- In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
- Figures are rounded for display to 3 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.
How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.
Frequently Asked Questions
How is VPN Capacity calculated?
aggregate = peers × bandwidth per peer; gateways = ceil(max(aggregate ÷ 70% of crypto throughput, tunnels ÷ 70% of tunnel limit)). A VPN gateway hits one of two ceilings: encrypted bits per second through the crypto engine, or the number of security associations it can hold. Size against both, target 70% of each so a failover or growth spurt does not tip you over, and take the larger gateway count.
Why does VPN Capacity matter?
Remote-access designs almost always run out of tunnels before bandwidth while site-to-site designs run out of bandwidth first, so sizing on only one number produces the wrong platform.
What values do I need to enter?
This calculator takes 5 inputs: Concurrent VPN users or sites, Average bandwidth per peer, Gateway IPsec/crypto throughput, Maximum tunnels per gateway, Tunnels per peer. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Does split tunnelling change the sizing?
Dramatically. Full-tunnel forces all internet traffic through the gateway, often tripling or quadrupling per-user bandwidth; split tunnelling carries only corporate destinations. Model both — the pandemic-era capacity crunches were almost entirely full-tunnel policies applied to newly remote workforces.