CSS series only runs SwOS which doesn’t work the way you described desired configuration.
CRS runs ROS and should be fine. However: only single bridge can be HW offloaded, if you use more bridges traffic of those will be handled by CPU (which in turn means that performance will be crap).
It is possible to “segment” a bridge to 3 partitions … and I can think of 2 ways:
- by using horizon properry of bridge ports … I’m not entirely sure tgat this is handled by switch chip so this way may degrade performance
- by introducing VLANs (albeit only internally to the device) and setting ports appropriate PVID value. This kind of setup should definitely be HW offloaded by CRS326 you’re mentioning.
IMO going the way #2 above is the way to go. In this case, if port VLAN membership is properly configured (specially of bridge interface), only a tiny set of firewall filter rules will be necessary (if at all).
Some reading, useful for way #2 - not recipes, but good foundations to build your own setup. And probably in this order as well:
http://forum.mikrotik.com/t/routeros-bridge-mysteries-explained/147832/1
http://forum.mikrotik.com/t/using-routeros-to-vlan-your-network/126489/1