I found http://forum.mikrotik.com/t/using-routeros-to-vlan-your-network/126489/1 which looks helpful. I’m going to try to configure the two routers with modified versions of router.rsc and switch.rsc just to see if I can get something with VLANs working.
What I don’t understand is how to configure the failover WAN2 VLAN for the 4G LTE modem connected to ether1 on the Floor-1 router. Specifically, in switch.rsc:
# WAN2 VLAN
add bridge=BR1 interface=ether1 pvid=20 comment="Netgear LM1200 4G LTE Modem -- Add to bridge?"
add bridge=BR1 interface=ether2 pvid=20
# Only allow ingress packets without tags on Access Ports
/interface bridge port
set bridge=BR1 ingress-filtering=yes frame-types=admit-only-untagged-and-priority-tagged [find interface=ether1] comment="ether1 on bridge?"
The DHCP client for WAN2 would run on the Border router as I have it now, yes?
Also, the PalaceSecurity PC needs to manage the routers and all other devices on the Main VLAN, so it doesn’t seem to make sense to have the separate BASE VLAN for router management.