hAP be³ Media as a 2.5G router: Any performance concerns?

Hello all,
I'm considering using the upcoming MikroTik hAP be³ Media as my main router with a Freebox modem in bridge mode (french isp "FREE", France, see free.fr for more details) .

What attracts me is the price, the built-in Wi-Fi (enough for my 40 m² apartment), and the 2.5 GbE port.

My only concern is the block diagram: ether1 (the potential WAN port) doesn't appear to be connected to the switch chip. I don't need any advanced firewalling or routing, but I'll have a 5 Gbps down / 900 Mbps up fiber connection that can saturate the 2.5 GbE WAN port.

Should I be concerned about routing performance because ether1 isn't on the switch chip, or is this a non-issue on this kind of platform? Has anyone looked into this or have experience with similar MikroTik hardware?

tips, feedback of any kind is welcome!

A bit of context maybe, I just acquired an old routerboard (951G 2HnD) to get my feet wet with routerOS, I am very much new to the Mikrotik ecosystem.

Cheers

The direct link between WAN Port and CPU is in theory a good thing, as the 2.5 Gb link Is esclusive (while the 4 other ports share another similar one), in practice It depends.
We don't have yet any reports of these devices tested on the field, unfortunately the last previous devices (hex refresh, hex s (2025) and hAP Ax S) have had some issues (afaik only partially solved) with throughput speed with a similar block diagram on that single, dedicated link.

The CPU should be slower than the one inside the hAP ax³ (same Cortex-A53, 17% slower clock speed). Which means you'll absolutely need to have Fasttrack active to reach anywhere near 2.5Gbps routing throughput. Fasttrack active means:

  • Mangle mark-routing or mark-packet not usable.
  • Firewall rules with conditions based on traffic rate not usable.
  • No simple queue or queue tree with parent=global usable.
  • DHCP snooping not usable.
  • According to the docs, no VRF should be configured (I have not tested this to confirm).

@CGGXANNX

But for the intended use as router/AP for a 40 m² apartment, presumably with less than 10 devices connected at the same time those features are unlikely to be needed.

If there is some (driver, RouterOS, or whatever) bottleneck/problem reducing the speed on the ether1 similar to the ones have been reported for the mentioned devices (that have been worked around using one of the "other" 4 ports as WAN and/or using queues, the limitation in queues may become a problem (or not)?

I really would like to have 2.5g to at least 2 to 3 clients. The other option (more expensive)
is to use the https://mikrotik.com/product/rb5009ug_s_in + the https://mikrotik.com/product/crs310_8g_2s_in, and I would have to reuse an old TPlink router as an AP. But this is significantly more expensive + the switch is not silent.

Maybe I missed some other device capable of routing 2.5g with a small set of firewall rules.

The usual "rule of the thumb" to assess (approximately) how fast is a Mikrotik router is in the corresponding "Ethernet test results":
https://mikrotik.com/product/hap_be3_media

The value taken is (the Mbits) "Routing 25 ip filter rules" for 512 byte size packets.
In this case it is 1208.7.

This is the least available speed, in most configuration cases it will be faster than that (because of fasttrack/fastpath) usually some 2x, and in a few cases even more.

I wouldn't be surprised if with the default Mikrotik firewall (and without any of the things
CGGXANNX listed) you could reach some 2200-2400, but since the device is still at the moment "vapourware" there are no reports on how much actually fast it is on the field.

The RB5009:
https://mikrotik.com/product/rb5009ug_s_in
corresponding value is 3096.2 Mbits, it is simply on another planet.

Do you really need a switch with 8 2.5 Gb ports (+2 SFP's) in a 40 m² apartment?
5-1+8-1=11 ports total

With a CRS304 (which is passive cooled) you would have 5-1+4-1=7 ports total