L3HW Firewall Offloading - Doesn't Offload Inter-VLAN traffic

One thing that would help to disambiguate:

l3 hw offload - stateless offload of IPv4/IPv6 routes into hardware
l3 fw offload - stateful offload of IPv4 connections and NAT (IPv6 fastpath/fasttrack yet to be implemented)

Brief list of what we discovered with fw offload in our lab and in prod for an ISP CG-NAT gw. More details in this thread: http://forum.mikrotik.com/t/how-does-l3hw-actually-works/155752/1

Limitations of fw-offload (as of 7.6) -

  • No LACP
  • No VLANs
  • No hairpinning on a single port
  • must have dedicated in and out physical interfaces

Config requirements (once you’ve removed limitations above:

Must have l3-hw-offloading=yes on the switch chip but disabled on all ports
Must create mangle rules to use fasttrack on connections that you want to offload to hardware

MikroTik may be able to comment if the gap on these limitations has closed between 7.6 and 7.8rc2.