Does this setup makes sense?

RouterOS Beginner Basics
1

Hello Everyone.

I’m redoing my home/shop/lab network.

Hardware:
RB5009UG+S+IN
CRS328-24P-4S+RM
2x cAPGi-5HaxD2HaxD
RBwAPG-5HacD2HnD

The CRS and RB5009 will have a 10Gbps sfp+ link, dmz will be on the 2.5Gbps ether1 of the RB and the rest will have 1Gbps.

I plan to make around 10 VLANs to separate all the crap from the shop and home networks.

I’m thinking that I’ll use the CRS to perform inter vlan routing (hw offloaded) and the RB5009 for routing to the internet.
Does this setup makes sense or is it better to just do a router on a stick setup?

2

That should perform admirably.

I wish more people would think to offload switching to a dedicated switch like that.

3

Good point,
So the switch does DHCP etc, and one only hits router routing limits when going to the internet??

More specifically, what happens when vlanX needs to hit VLANY, is this somehow routed between subnets at wirespeed then??
(function of switch).???

Cause when I look at ethernet test results of switch with 25 filter rules, the throughput goes down to 250Mbps ???

4

Use some combination of hardware inter-VLAN routing and hardware VLAN filtering. This takes up precious ACL rule space, but 128 rules is enough for a home lab, no problem.

5

This is exactly what I’m aming for.
Within a VLAN traffic will be covered by L2 hardware offload, intra-vlan routing will be done by L3 hw offload and internet would be routed to the RB (also should be L3 offload) via 10G link.
The RB will run firewall/NAT.
DHCP, etc. will run on the CRS as the CPU will have very little to do.

6

Yes, and if you find yourself needing to do any serious firewalling, you can bounce the packets up from the CRS328 to the RB5009 for a decision. This duplicates the I/O, but that shouldn’t be a significant concern since it’s a full-duplex connection. The RB5009 is capable of making these decisions at a rate of gigabits per second, whereas the CRS328 is not once you exceed the limitations of its L3HW functionality.

7

Very interesting, I didnt know that you could
a. create the vlans and do DHCP on the switch
b. run the fw rules on the router.