I currently have a network with a USB LTE modem connected to a mikrotik router that 1) provides hotspot management and (and user management for the hotspot) to a small campus and 2) provides non-hotspot service to the same campus via a different SSID than that used for the hotspot.

I want to replace the USB LTE modem with an SXT LTE. Clearly the LTE cannot support the hotspot and user management due to lack of memory and disk. Currently I have one cable going to a tower where the router and LTE modem are located as well as an SXT-5 that feeds the local network (connected to the router and powered via POE out from the router. I'm planning on pulling the router off the tower and replacing it with the SXT LTE, while leaving the SXT-5 in place.

What is the best way to accomplish my goal? I see at least one way to do it: On the SXT LTE, bridge the LTE interface to one of the ethernet ports and bring it down the cable to the router where the DHCP client for the WAN would be located as well as normal NAT, the hotspot NAT and user manager. If I also want to access the SXT LTE management interface I would use a VLAN on the same cable to go back to the SXT LTE. I could also then use the second interface on the SXT LTE to connect to the SXT-5 on the same VLAN and use an additional VLAN for the Hotspot traffic that flows through the SXT-5. This uses only one cable for power and data up the tower for both SXT radios. It has the disadvantage of causing all the traffic to the internet from the campus served by the SXT-5 to go through the single cable twice (once up/once down). Alternatively, I could run a separate additional cable for the SXT-5 to avoid this.

Is this the best way to do this? Are there other, better, ways to accomplish my goal? I don't think that doing NAT on the SXT LTE and doing hotspot and user management on the separate router is possible, but perhaps it is and I just don't know how to do it.

I can't see why you couldn't run your NAT and firewall on the SXT-LTE, then just route between the two inside your network. There are a couple of IP routing changes you may need to make, specifically so your other router points its default route to the SXT and also so the SXT has routes back to all your internal networks.

Thanks for the advice. I see that all I need to do is set a route back from the SXT-LTE to the hotspot server and I can disable the masquerade (except for the local network) on the hotspot server as well.