I recommend to keep the internet gateway and the internal switching separated.
RB2011 (600MHz) can do about 800mbps IPv4 NAT with default firewall rules and Fasttrack… but at full CPU.
CRS305 (800Mhz) are similar… but adding firewall rules disables Fast Path.
Fasttrack and Fast Path: http://forum.mikrotik.com/t/fastpath-fasttrack-l2hw-l3hw-clarification/155333/1