Separate SDN gateway capacity from tunnel throughput limits

Source facts

The 2016 model allocates tunnel bandwidth using ratios of the configured gateway capacity. For the 2019 model, Microsoft describes fixed maximum throughput for each tunnel type; a faster gateway network adapter does not remove that tunnel limit. IPsec defaults to the older allocation behavior; the documented transition requires enabling the gateway service and restarting the gateway VM. Microsoft Learn.

Applicability

Record the active allocation behavior, tunnel type, gateway service state, and pool upgrade state, not just the server version. Consult the documented transition conditions before selecting a calculation. Keep product ceilings separate from measured throughput, and schedule any required restart through the change process.

DSE recommendation

Build a capacity worksheet that names each tunnel, its traffic requirement, configured allocation, and the applicable documented calculation. Ask the network owner to identify concurrent workloads and the acceptable behavior under contention. Avoid filling the gateway-capacity field with an arbitrary large value to make the worksheet appear sufficient. Have the application owner approve a realistic test load and observation period.

Verification

Measure traffic through the actual tunnel type while recording gateway resources and simultaneous traffic. Compare observed throughput with the allocation worksheet and investigate the limiting component. Repeat the relevant condition with the planned concurrency. Record both the measured result and the product-model assumption so later version changes trigger a fresh review.

Official references

Microsoft Learn: Gateway bandwidth allocation. Source reviewed September 8, 2026.