I am not a MikroTik or networking newb, but I wanted to run a scenario by the group to see if this is the best configuration and would be secure.
Current setup:
I currently have Xfinity with 2Gig service. Their cable modem’s 2.5G port directly connects to my RB5009’s 2.5G port. I then have the RB5009’s SFP+ port (10G fiber) connecting to a CRS309. This all works great as I can use the full 2Gig service from Xfinity and have local 10G connectivity.
The problem:
I am about to get T-Mobile fiber (fiber to home) installed, but my RB5009 is already using the SFP+ port for my CRS309.
What I would like:
I would like to connect the new T-Mobile fiber to a spare SFP+ port on my CRS309, and run a 1/2.5/5/10G copper SFP back to the 2.5G port on my RB5009 to provide internet.
My question:
If I just bridged the spare 10G fiber SFP port (T-Mobile in on switch) to the spare 10G copper SFP port (switch to router), would there be any other security issues I should worry about? Any other config on the switch to ensure the security of my network?
It depends on the type of service your ISP provides.
When it is PPPoE, there is no issue doing that. But when it is plain ethernet (DHCP) you should instead make a VLAN, put that untagged on the port where the ISP connection is and tagged on the port where the router is connected (use a VLAN number between 2 and 4090). Then put a VLAN interface with the same VLAN number in the router (parent is the bridge) and configure that as your WAN interface.
I'd recommend this kind of setup also for "plain IP" WAN ...
And further: if you don't foresee congestion on the 10Gbps interconnect between CRS and RB5009, it would make things easier just to use this link as trunk ... carrying both WAN VLAN and LAN VLAN(s).
I was going to suggest exactly as @mkx proposed, what’s referred to as a router-on-a-stick setup. Your rb5009 would connect to the rest of the network on its sfp port only and receive both wan and lan subnets on vlans, essentially using only vlan interfaces to route.
Due to the excellent performance-price ratio of the rb5009, and the fact that it only has a single sfp+ port, this is a quite common setup.
Especially if you consider that you’re free to use the rest of the gigabit (and the 2.5G) port for you gigabit needs, this is quite a nice setup. (The rb5009 has a quite capable switch chip, so with its ports automatically offloaded, it acts as an additional gigabit managed switch locally.)