I'd like to replace my Access switch with a CRS device of some kind. I have a CRS309 that function as a "Core" switch.

If I have, say, 4 VLANs, and I need to use filtering to keep the "untrusted" devices away from the "trusted" devices, what kind of performance can I expect? For example the CRS328 has 63,167.8Mbps of non-blocking layer 2 throughput. Can I get the same performance with VLAN filtering?

You should get performance very near to the figure you're quoting .... if you configure device properly. The actual figure might be a few percent lower, depending on how you measure (VLANs come with 802.1q headers which are almost 3% of standard full-size ethernet frame). Since these devices handle VLANs in ASICs (if we're talking about switching between wired ports) so it should be done without any CPU intervention (and load).

Thanks for the input.

Is this only true of the devices with "hardware offload"?

I'd like to replace my Access switch with a CRS device of some kind. I have a CRS309 that function as a "Core" switch.

If I have, say, 4 VLANs, and I need to use filtering to keep the "untrusted" devices away from the "trusted" devices, what kind of performance can I expect? For example the CRS328 has 63,167.8Mbps of non-blocking layer 2 throughput. Can I get the same performance with VLAN filtering?

Yes, that's true for devices with VLAN HW offload. Then there are (older) devices with switch chip (CRS1xx, CRS2xx, most small SoHo routers) where it's possible to configure switch chip to deal with VLANs but one has to use (device specific) switch chip configuration subtree. Obe only has to consider all required functions and check if particular combination is supported, some switch chips don't support certain (advanced?) features ... but simple VLAN-aware switching is supported by most devices with switch chip this way or another (with possible caveats on some particular device models).