# Separate SDN gateway capacity from tunnel throughput limits

> How should SDN gateway capacity be interpreted when planning tunnel bandwidth?

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260908-171-separate-sdn-gateway-capacity-from-tunnel-throughput-limits/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-08T18:14:20+00:00
- Modified: 2026-09-08T18:26:31+00:00
- Last reviewed by DSE: 2026-09-08
- Resource type: Guide
- DSE priority: Information
- Topics: IT, Networks & Infrastructure
- Reading time: 2 minutes

## What you need to know

How should SDN gateway capacity be interpreted when planning tunnel bandwidth?

## Potentially affected

Administrators sizing Windows Server SDN gateway tunnels.

## DSE recommendation

Build a capacity worksheet that names each tunnel, its traffic requirement, configured allocation, and the applicable documented calculation.

## Article

## Source facts

The 2016 model allocates tunnel bandwidth using ratios of the configured gateway capacity. For the 2019 model, Microsoft describes fixed maximum throughput for each tunnel type; a faster gateway network adapter does not remove that tunnel limit. IPsec defaults to the older allocation behavior; the documented transition requires enabling the gateway service and restarting the gateway VM. [Microsoft Learn](https://learn.microsoft.com/en-us/windows-server/networking/sdn/gateway-allocation).

## Applicability

Record the active allocation behavior, tunnel type, gateway service state, and pool upgrade state, not just the server version. Consult the documented transition conditions before selecting a calculation. Keep product ceilings separate from measured throughput, and schedule any required restart through the change process.

## DSE recommendation

Build a capacity worksheet that names each tunnel, its traffic requirement, configured allocation, and the applicable documented calculation. Ask the network owner to identify concurrent workloads and the acceptable behavior under contention. Avoid filling the gateway-capacity field with an arbitrary large value to make the worksheet appear sufficient. Have the application owner approve a realistic test load and observation period.

## Verification

Measure traffic through the actual tunnel type while recording gateway resources and simultaneous traffic. Compare observed throughput with the allocation worksheet and investigate the limiting component. Repeat the relevant condition with the planned concurrency. Record both the measured result and the product-model assumption so later version changes trigger a fresh review.

## Official references

[Microsoft Learn: Gateway bandwidth allocation](https://learn.microsoft.com/en-us/windows-server/networking/sdn/gateway-allocation). Source reviewed September 8, 2026.

## Primary reference

- Name: Gateway bandwidth allocation
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/windows-server/networking/sdn/gateway-allocation
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Separate SDN gateway capacity from tunnel throughput limits,” DSE Security, https://update.dsesecurity.com/updates/dse-20260908-171-separate-sdn-gateway-capacity-from-tunnel-throughput-limits/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.