If I am running an IPSEC tunnel over an ADSL connection with bandwidth limits 2mbps down and 1mbps up is the bandwidth over the tunnel limited to 1mbps in both directions or is it also asynchronous?

Update: The answers so far haven't helped, so maybe I should give some more info of why I am asking the question.

Currently all of our resources are located at our data center, and clients in remote offices access these resources via IPSEC - each office has an ASA 5505 that has a VPN link to an ASA 5510 at the data centre. We use split tunnelling so that traffic not destined for the data center does not have to go over the IPSEC tunnel.

Many of our offices are on asynchronous connections (ADSL and VSAT for example) where the upload bandwidth is typically half the download bandwidth.

We are currently looking at the option of moving our file storage to a cloud provider, in which case the clients would access the files via HTTPS, rather than over the VPN.

One of the possible cases supporting the change would be a performance benefit. It has been suggested to me that users in asynchronously connected offices may potentially see a doubling of download speeds because traffic down an IPSEC tunnel in either direction is limited by the slowest direction. Is this true?


IPsec doesn't perform any traffic control, so packets will be sent and received as quickly as possible (as usual), so the tunnel will also be asynchronous.


It depends exactly where the two endpoints of the traffic are. If they're both on the Internet side of the ADSL connection, then yes (since traffic has to be received by the ADSL connection, put into or taken out of the tunnel, and then transmitted over the ADSL connection). Otherwise, no.

  • Can you rephrase that because I really don't understand what you are trying to say. – dunxd Feb 8 '13 at 22:44
  • Okay, you have an IPSEC tunnel. Traffic must get to one end of that tunnel and must leave the other end of that tunnel. If both of those paths are across the ADSL connection, then tunnel traffic must be both received over that connection and sent over that connection. So the bandwidth is limited to the slowest direction of the ADSL connection, total for both directions of traffic taking the tunnel. Otherwise, it's not. – David Schwartz Feb 8 '13 at 23:05
  • Hmm - so the opposite of what mgorven said, and someone voted them up. Hopefully there will be some more votes or comments to clarify. – dunxd Feb 8 '13 at 23:07
  • mgorven's answer is 100% correct, it just doesn't really answer your question. If you're on the road and use the IPSec tunnel to reach Google, then every packet you send to or receive from Google has to cross your ADSL line twice, once in each direction, once in the tunnel and one outside it. – David Schwartz Feb 8 '13 at 23:09
  • Fleshed out the question a bit, because I am still confused :-) – dunxd Feb 8 '13 at 23:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.