Abstract: The expected processing bandwidth of System Processing Units (SPUs) in an extranet gateway is first assessed, for example by multiplying a CPU processor speed by a conversion factor or determining the type of accelerator, and then adjusting the capacity to take into account other processing requirements on the SPU. Once assessed, a load distribution system assigns tunnels to the SPUs based on their processing capacity. As tunnels are assigned and torn down, the estimated available processing capacities of the SPUs are adjusted to account for the assignment or release of the system processing resources attributable to those VPN services. Tunnel assignment may take into account the ability of a SPU to handle the type of tunnel, the absolute or relative capacity of the SPUs, the type of tunnel being assigned, features of the tunnel such as the presence of compression, and efficiencies of the SPU at handling that tunnel type with selected features.