How many IPSEC Phase 2 SA's can exist for a given VPN tunnel before performance becomes an issue, and at this point what causes the performance issue?

This is posed because I've always asked about specific configs vs specific configs for VPN and which is more efficient and I want to be able to answer this myself based on some real data. I'm hoping to get feedback from people with more robust VPN backgrounds, who can say - through experience - I see performance drop after X phase 2 SA's, and here's why - so that I can then take this and create my own plan for good crypto ACL's.

  • Hi AL, could you please add more context to the question? Information about why you are concerned about this, the platform, os version, and manufacturer would help Aug 1, 2014 at 16:55
  • Sure, I'm on it!
    – A L
    Aug 1, 2014 at 16:55
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Aug 8, 2017 at 21:35

1 Answer 1


Depending on platform, performance shouldn't be an issue up into the thousands of SAs -- table lookups aren't that expensive. However, every system I'm aware of limits the total number of SAs, either due to hardware constraints or "lazy programming" (fixed size table.)

That said, it's best to have as few SAs as you can -- eg. 1 /20 vs. 16 /24's -- to reduce the setup time and amount of key renegotiation (which is computationally expensive.)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.