drinkingbird
Part of the Furniture
Really the only reason to run FT would be to run it in AP mode with VLANs and have your main router act as the DHCP server, firewall, etc. It is definitely not running in router mode right now.
The only benefit I can think to running FT in router mode in your setup (in that case you would not need VLANs) is that its firewall rules may be more flexible than stock/merlin firmware so that may make it easier for you to configure the access you do/don't want between the networks. It would also let you eliminate your switch you have sitting there (assuming you don't need more than 5 physical ports at that location) as it lets you segment the physical ports also where stock/merlin does not without some simple scripting.
The disadvantage is that it is extremely complex and designed for power users who know a lot about networking. So it will be difficult for you to get set up, and there is a much higher chance you'll miss something and not end up with the segmentation you want. So if you want to keep FT (in router or AP mode) you'll need to do a bunch of testing when you're done to make sure all the access controls you want are actually working and stuff is segmented with only the traffic you want able to get between the networks. Technically it also isn't updated as much so may not be as secure as Asus or Merlin, but since it is not facing the internet that isn't as big of a concern.
In one of the screenshots you can see it says something like "set WAN vlan first" so you haven't finished configuring the initial setup yet even, probably why you aren't able to set it into router mode.
Yeah they just assume that is the easier path than configuring port forwarding and firewall rules etc. And it may very well be, if you have the second NIC anyway and it is right there, technically you can just do that, as long as you're comfortable that the blue iris PC won't route traffic between the two networks (defeating the purpose). Having a single device connected to two different "security zones" is technically bad network design, but in the home environment it isn't as big of a concern, especially if it is behind a firewall (your main router).
I was only referring to LAN performance, so the bandwidth between the NVR and the cameras. 500M should be more than enough I'm assuming. Having two NICs would give you the full gig as it isn't passing through a router, just a switch in that design.
If you have no need/desire for AIMESH then can take that off the table.
If you definitely want to run FT then first make sure you're running the latest (at least 2021.8 but hopefully there is a newer version than 2 years old). Then you need to decide if you want to run it as an AP with VLANs to extend your main router's segmented networks (will require dual NIC on the NVR or a script on the main asus to allow communication between the two) or as a second router (which could potentially eliminate the second NIC requirement).
One other benefit to FT is that you could eliminate the switch you have sitting there and just use the router ports sitting in different VLANs. This would work in either router or AP mode. This could also be done with some simple scripting on the Asus in AP or router mode too.
So I guess decide what combination is right for you and we'll go from there.
If you want least complex, totally done through the GUI, no scripting, and don't want AIMESH, then dual router with Merlin 386.11 on both is probably going to be the simplest.
If you want a bit more flexibility and some advanced features/power user stuff, potentially being able to remove that extra switch, etc, then FT on the second router (in either router or AP mode) is the way go but you'll need to spend more time learning FT and testing to make sure you got it right.
