hAP be³ Media Capability Questions

Hardware MikroTik hardware general
1

Hello!

I am looking into the hAP be³ Media and had a few questions:

  1. Is this router available in the United States right now? I couldn't find it on my local retailer's page.
  2. Does the Qualcomm IPQ-5322 support hardware accelerated crypto such as AES? If so, is RouterOS able to take advantage of it?
  3. Since the model supports containers, would it be reasonable to run an Xray VLESS + REALITY server on it? My use case is very small (at most two simultaneous clients), so I don't expect CPU utilization to be a limiting factor.
  4. I currently run Xray on a Raspberry Pi 4B, which tops out at around 800 Mbps over my LAN. I have a 2 Gbps Internet connection, so I am curious whether the hAP be³ Media would be capable of higher VPN throughput, or whether I should expect similar performance. Would the router's networking hardware provide any meaningful advantage here, or would containerized applications still be primarily CPU-bound.

For comparison, the Pi's OpenSSL AES-128 GCM results are approximately:

Doing AES-128-GCM ops for 3s on 16 size blocks: 2113759 AES-128-GCM ops in 3.00s
Doing AES-128-GCM ops for 3s on 64 size blocks: 1313293 AES-128-GCM ops in 3.00s
Doing AES-128-GCM ops for 3s on 256 size blocks: 598868 AES-128-GCM ops in 2.99s
Doing AES-128-GCM ops for 3s on 1024 size blocks: 189066 AES-128-GCM ops in 3.00s
Doing AES-128-GCM ops for 3s on 8192 size blocks: 25483 AES-128-GCM ops in 3.00s
Doing AES-128-GCM ops for 3s on 16384 size blocks: 12809 AES-128-GCM ops in 3.00s
version: 3.5.6
built on: Wed Jun 10 17:36:10 2026 UTC
options: bn(64,64)
compiler: gcc -fPIC -pthread -Wa,--noexecstack -Wall -fzero-call-used-regs=used-gpr -Wa,--noexecstack -g -O2 -Werror=implicit-function-declaration -ffile-prefix-map=/build/openssl-abkmeq/openssl-3.5.6=. -fstack-protector-strong -fstack-clash-protection -Wformat -Werror=format-security -mbranch-protection=standard -DOPENSSL_USE_NODELETE -DOPENSSL_PIC -DOPENSSL_BUILDING_OPENSSL -DZLIB -DZSTD -DNDEBUG -Wdate-time -D_FORTIFY_SOURCE=2
CPUINFO: OPENSSL_armcap=0x81
The 'numbers' are in 1000s of bytes per second processed.
type             16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes  16384 bytes
AES-128-GCM      11273.38k    28016.92k    51274.32k    64534.53k    69585.58k    69954.22k

AES-256 GCM:

Doing AES-256-GCM ops for 3s on 16 size blocks: 1906484 AES-256-GCM ops in 3.00s
Doing AES-256-GCM ops for 3s on 64 size blocks: 1173927 AES-256-GCM ops in 3.00s
Doing AES-256-GCM ops for 3s on 256 size blocks: 514610 AES-256-GCM ops in 3.00s
Doing AES-256-GCM ops for 3s on 1024 size blocks: 160577 AES-256-GCM ops in 3.00s
Doing AES-256-GCM ops for 3s on 8192 size blocks: 21532 AES-256-GCM ops in 3.00s
Doing AES-256-GCM ops for 3s on 16384 size blocks: 10809 AES-256-GCM ops in 3.00s
version: 3.5.6
built on: Wed Jun 10 17:36:10 2026 UTC
options: bn(64,64)
compiler: gcc -fPIC -pthread -Wa,--noexecstack -Wall -fzero-call-used-regs=used-gpr -Wa,--noexecstack -g -O2 -Werror=implicit-function-declaration -ffile-prefix-map=/build/openssl-abkmeq/openssl-3.5.6=. -fstack-protector-strong -fstack-clash-protection -Wformat -Werror=format-security -mbranch-protection=standard -DOPENSSL_USE_NODELETE -DOPENSSL_PIC -DOPENSSL_BUILDING_OPENSSL -DZLIB -DZSTD -DNDEBUG -Wdate-time -D_FORTIFY_SOURCE=2
CPUINFO: OPENSSL_armcap=0x81
The 'numbers' are in 1000s of bytes per second processed.
type             16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes  16384 bytes
AES-256-GCM      10167.91k    25043.78k    43913.39k    54810.28k    58796.71k    59031.55k

The Raspberry PI reports ARM64 features including:

fp asimd evtstrm crc32 cpuid

I'm mainly looking to consolidate my networking setup into a single device if that makes sense, while improving the functionality of my existing setup as a bonus.

Thanks!

2

The usual proxy to have an idea of the performance of a Mikrotik device is "test results", the "routing 25 ip filter rules" with 512 bytes packets is usually reflecting real device performance.

For the hAP be3 it is 1208.7 Mbps.

Usually, in particular configurations, these performances can be increased, but not in all cases/setups.

So, it is a rather beefy Access Point and Router, but not a particularly powerful device.

With a 2 Gb connection (you lucky bastard :wink:) I would go for a RB5009 that has in the same place 3096.2 Mbps.

Also consider how only a few units are being delivered in EU, so likely US will come later (it is/will be a different model MA53UG+HbeH-US) probably end of the year or so, which may not be a bad thing if you can wait as like all "new" devices there are a few quirks that will probably be fixed with newer ROS versions.