Well since it took Microtik three days to approve my post, I worked it out in the meantime. If you have multiple master ports it looks like sharing VLAN configuration across/between them may not work because, well, they’re isolated from each other.
My design resulted in me having two master ports. ether1 is the master for ports ether2 through to ether23, and ether4 is its own master as it does not need to take part in any of the VLANs used on the other ports. I use that port as a direct link to a DSL modem in bridge mode, so my interface on the CRS is a PPPoE inteface which is bound directly to ether24.
Here’s the code:
#### Configure all switch ports except port 24 to be in the same isolation group. Port 24 is for DSL so is placed in separate isolation group.
/interface ethernet
set [ find default-name=ether1 ] name=ether1-master-local
set [ find default-name=ether2 ] master-port=ether1-master-local name=ether2-slave-local
set [ find default-name=ether3 ] master-port=ether1-master-local name=ether3-slave-local
set [ find default-name=ether4 ] master-port=ether1-master-local name=ether4-slave-local
set [ find default-name=ether5 ] master-port=ether1-master-local name=ether5-slave-local
set [ find default-name=ether6 ] master-port=ether1-master-local name=ether6-slave-local
set [ find default-name=ether7 ] master-port=ether1-master-local name=ether7-slave-local
set [ find default-name=ether8 ] master-port=ether1-master-local name=ether8-slave-local
set [ find default-name=ether9 ] master-port=ether1-master-local name=ether9-slave-local
set [ find default-name=ether10 ] master-port=ether1-master-local name=ether10-slave-local
set [ find default-name=ether11 ] master-port=ether1-master-local name=ether11-slave-local
set [ find default-name=ether12 ] master-port=ether1-master-local name=ether12-slave-local
set [ find default-name=ether13 ] master-port=ether1-master-local name=ether13-slave-local
set [ find default-name=ether14 ] master-port=ether1-master-local name=ether14-slave-local
set [ find default-name=ether15 ] master-port=ether1-master-local name=ether15-slave-local
set [ find default-name=ether16 ] master-port=ether1-master-local name=ether16-slave-local
set [ find default-name=ether17 ] master-port=ether1-master-local name=ether17-slave-local
set [ find default-name=ether18 ] master-port=ether1-master-local name=ether18-slave-local
set [ find default-name=ether19 ] master-port=ether1-master-local name=ether19-slave-local
set [ find default-name=ether20 ] master-port=ether1-master-local name=ether20-slave-local
set [ find default-name=ether21 ] master-port=ether1-master-local name=ether21-slave-local
set [ find default-name=ether22 ] master-port=ether1-master-local name=ether22-slave-local
set [ find default-name=ether23 ] master-port=ether1-master-local name=ether23-slave-local
set [ find default-name=sfp1 ] master-port=ether1-master-local name=sfp1-slave-local
set [ find default-name=ether24 ] name=ether24-DSL
#### Define the VLAN interfaces and create the VLAN IDs at the same time
/interface vlan
add name=vlan110 vlan-id=110 interface=ether1-master-local
add name=vlan10 vlan-id=10 interface=ether1-master-local
#### Define the IP addresses of the CRS-125 routing engine and assign them to VLAN interfaces
/ip address
add address=192.168.0.254/24 interface=vlan10 network=192.168.0.0
add address=<REDACTED>/25 interface=vlan110 network=<REDACTED>
#### Configure the PPPoE interface for the link to the ADLS modem/bridge. Set route distance to 2 so this link is not used unless vlan110 goes down.
/interface pppoe-client
add add-default-route=yes default-route-distance=2 disabled=no interface=\
ether24-DSL keepalive-timeout=disabled name=Internode-PPPoE password=\
<REDACTED> user=<REDACTED>
#### Configure the default static route and check gateway using ping. Route cost is 1 so that PPPoE won't be used unless this link goes down.
/ip route
add check-gateway=ping distance=1 gateway=<REDACATED>
### Allocate the list of valid VLANs to ports. **MUST** add switch1-cpu to any VLANs which are routed.
/interface ethernet switch vlan
add ports="ether1-master-local,ether2-slave-local,ether3-slave-local,ether4-sl\
ave-local,ether5-slave-local,ether6-slave-local,ether7-slave-local,ether8-\
slave-local,ether9-slave-local,ether10-slave-local,ether11-slave-local,eth\
er12-slave-local,ether13-slave-local,ether14-slave-local,ether15-slave-loc\
al,ether16-slave-local,ether17-slave-local,ether18-slave-local,ether19-sla\
ve-local,ether20-slave-local,ether21-slave-local,ether22-slave-local,ether\
23-slave-local,switch1-cpu" vlan-id=10
add ports=ether1-master-local,switch1-cpu vlan-id=110
#### Define VLAN tagging. Switch1-cpu is always tagged for routed VLANs. Ethernet trunk port to core switch is also tagged.
/interface ethernet switch egress-vlan-tag
add tagged-ports=ether1-master-local,switch1-cpu vlan-id=10
add tagged-ports=ether1-master-local,switch1-cpu vlan-id=110
#### Assign a VID to packets entering interfaces when they are not tagged, otherwise they belong to VLAN 0 (zero). Ether24 not listed, as it is segmented using an isolation group (i.e. it is a master port) and has no VLAN assigned.
/interface ethernet switch ingress-vlan-translation
add new-customer-vid=10 ports="ether2-slave-local,ether3-slave-local,ether4-slave-local,ether5-slave-local,ether6-slave-local,et\
her7-slave-local,ether8-slave-local,ether9-slave-local,ether10-slave-local,ether11-slave-local,ether12-slave-local,ether13-s\
lave-local,ether14-slave-local,ether15-slave-local,ether16-slave-local,ether17-slave-local,ether18-slave-local,ether19-slave\
-local,ether20-slave-local,ether21-slave-local,ether22-slave-local,ether23-slave-local" sa-learning=yes