Where bottlenecks appear
IPsec throughput is often limited by the encryption capacity of the endpoint device rather than the internet link.
Hardware matters
Choose routers or firewalls with cryptographic acceleration, and check vendor throughput figures for your chosen ciphers.
Choose efficient algorithms
AES-GCM is both secure and fast on modern hardware with AES instructions.
Prevent fragmentation
Fragmented packets reduce performance. Clamp TCP MSS and set appropriate tunnel MTU.
Parallelise
Some devices process each tunnel on a single core. Multiple tunnels with load balancing can increase total throughput.
Test properly
Measure with multiple parallel flows and realistic packet sizes, not a single file transfer.
Know when to switch
If you consistently need very high throughput, a private circuit or Virtual Cross Connect may be more efficient.
