OK, here’s how I got it to work. If anyone stumbles across this, I hope it will help. My huge thanks to pcunite for his post " Using RouterOS to vLAN your Network." It was immensely helpful in finding the correct way to do this.
The firewall has a static IP in the same network as interface ethernet1. A default route to this provides routing out to the internet. Each vLAN is established on /interface vlan, untagged ports are added to the bridge with the pvid of their vLAN, tagged ports are added to the bridge with no pvid, and finally, each vLAN is added to /interface bridge vlan specifying the bridge, tagged and untagged ports. To enable inter-vLAN routing, then establish an IP address on each vLAN interface.
Please note that this config works, but is not necessarily secure or includes all of the items that might be necessary in your own environment. You should be able, however, to dump this config onto a CRS112 and get it to function with multiple routed vLANs and pass traffic up to a firewall.
# model = CRS112-8G-4S
/interface bridge
add name=BR1 protocol-mode=none vlan-filtering=yes
/interface vlan
add interface=BR1 name=Guest vlan-id=103
add interface=BR1 name=Office vlan-id=101
add interface=BR1 name=Mgmt vlan-id=99
add interface=BR1 name=Student vlan-id=102
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip hotspot profile
set [ find default=yes ] html-directory=flash/hotspot
/ip pool
add name=dhcp_pool0 ranges=10.10.100.50-10.10.100.100
add name=dhcp_pool1 ranges=10.10.101.50-10.10.101.99
add name=dhcp_pool2 ranges=10.10.102.50-10.10.102.199
add name=dhcp_pool3 ranges=10.10.103.50-10.10.103.199
/ip dhcp-server
add address-pool=dhcp_pool0 disabled=no interface=Mgmt lease-time=1d name=dhcp1
add address-pool=dhcp_pool1 disabled=no interface=Office lease-time=1d name=dhcp2
add address-pool=dhcp_pool2 disabled=no interface=Student lease-time=4h name=dhcp3
add address-pool=dhcp_pool3 disabled=no interface=Guest lease-time=2h name=dhcp4
/interface bridge port
add bridge=BR1 interface=ether8 pvid=99
add bridge=BR1 interface=ether7 pvid=99
add bridge=BR1 interface=ether6 pvid=102
add bridge=BR1 interface=ether5 pvid=103
add bridge=BR1 interface=ether2
add bridge=BR1 interface=ether3
add bridge=BR1 interface=ether4
/interface bridge vlan
add bridge=BR1 tagged=BR1,ether2,ether3,ether4 untagged=ether6 vlan-ids=102
add bridge=BR1 tagged=BR1,ether2,ether3,ether4 untagged=ether5 vlan-ids=103
add bridge=BR1 tagged=BR1,ether1,ether2,ether3,ether4 untagged=ether7,ether8 vlan-ids=99
add bridge=BR1 tagged=BR1,ether2,ether3,ether4 untagged=ether7 vlan-ids=101
/ip address
add address=10.10.1.2/24 interface=ether1 network=10.10.1.0
add address=10.10.101.254/24 interface=Office network=10.10.101.0
add address=10.10.102.254/24 interface=Student network=10.10.102.0
add address=10.10.103.254/24 interface=Guest network=10.10.103.0
add address=10.10.100.254/24 interface=Mgmt network=10.10.100.0
/ip dhcp-server network
add address=10.10.100.0/24 dns-server=208.67.220.123,208.67.222.123 gateway=10.10.100.254
add address=10.10.101.0/24 dns-server=208.67.220.123,208.67.222.123 gateway=10.10.101.254
add address=10.10.102.0/24 dns-server=208.67.220.123,208.67.222.123 gateway=10.10.102.254
add address=10.10.103.0/24 dns-server=208.67.220.123,208.67.222.123 gateway=10.10.103.254
/ip route
add distance=1 gateway=10.10.1.1
/system identity
set name=core-switch-0
/system routerboard settings
set silent-boot=no