VLAN - Interface and bridge question and setup

If you have not read at least the first post of RouterOS bridge mysteries explained by sindy, then you should read it. Be aware that MikroTik has added dynamic configuration since that was written, so not all entried in the /interace bridge vlan section are required in special circumstances. For example, when a pvid is specified for a port in /interface bridge port, then the vlan specified by the pvid will have a "hidden" dynamic entry for the port in the untagged part of /interface bridge vlan. And when vlan interface is created under the bridge, then the bridge will be included as tagged in the /interface bridge vlan for the specified vlan.

It has been a while since I worked with Cisco switches. So my recollection may be inaccurate.

In a cisco switch, all the ports are preconfigured as being switch-ports, and in the default config all switch-ports are part of the pre-configured Default vlan (vlan 1) and are configured as access ports for vlan 1.

If you are going to use multiple vlans in a Cisco switch, you first need to add the vlan. This is setting up the vlan table of valid vlan values. Each vlan defined is like a vitural switch (or a separate pair of conductors in a cable). And different vlans are kept separate from each other, each vlan is it own broadcast domain. Only switch ports that are members of the vlan can communicate directy at the MAC L2 layer. Whether a port is set to use tagged or untagged for a specific vlan depends on the port setting; the broadcast domain is the same (and each defined vlan has its own broadcast domain). That's all well covered by Ed Harmouse's stuff from Basic VLAN Access Port - #6 by Buckeye

Some differences between Cisco (IOS) and Mikrotik (Linux)

In Cisco, the switch is always operating in vlan-aware mode, it just has a default config where all ports are members of the default vlan (1) and are configured as access ports (but may be allowed to become trunk port dynamically with Dynamic Trunking Protocol, something that can be exploited if not disabled)

In Cisco when you set the native vlan, it affects both ingress and egress traffic; untagged ingress traffic will be classfied as belonging to the native vlan, and any egress traffic for the vlan associated with the native vlan will be sent without a vlan tag. In MikroTik the ingress behavior and egress behavior are controlled separately. The ingress behavior is controlled by /interface bridge port (where PVID the port vlan ID - very similar to native vlan, or access vlan in Cisco, it is the IEEE 802.1Q spec's terminolgy for which vlan untagged ingress traffic will use in the switch). The egress behavior is controlled by the /interface bridge vlan section that controls the vlan table, and in recent versions (7.16+) of ROS there can be dynamic configurations of the vlan table.

Note that the /interface bridge port (primarily ingress related) and /interface bridge vlan (primarily egress related) sections deal with the virtual switch configuration, and the some of the things are only applicable when the vlan-aware bridge is entabled.

Unlike Cisco, the default configuration of the bridge is not vlan-aware, but it is vlan-transparent. I.e. it acts like a "dumb switch" that does not treat ethertype 0x8100 (the TPID Tab Protocol Identifier) as anything special, valid ethernet frames received will be forwarded as-is, ingress untagged will be forwarded as untagged on egress, tagged ingress will be forwarded as tagged on egress.

When vlan-aware mode is enabled (with /interface bridge vlan-filtering=yes), it fundamentally changes the behavior of the virtual switch, which will then process the vlan tag and ports can be set to use ether untagged or tagged traffic for a vlan.

I find it helpful to use a spreadsheet to plan the configuration, then creating the config from the spreadsheet is a straight forward translation. For example see the two threads:
Beginners journey into VLANs and its continuation VLANed home network, 2nd try