I have a CRS312 which I have set up as a switch connected to a pfSense LAN interface. ROS obtains an IP address via DHCP and is initially reachable, but after some period of time becomes unreachable. By unreachable, I mean that the ROS web UI is unavailable nor does it respond to ARP queries. pfSense continues to show a valid DHCP lease. I have not done any significant configuration changes (I updated ROS, changed password, etc.)

In addition, if I insert another unmanaged layer 2 switch in between pfSense and ROS, I can get the web UI again. Also, ROS functions as a switch the entire time.

Is this a simple configuration problem I can fix? Does anyone have any troubleshooting suggestions? (I will try WinBox next time I observe the problem, as I understand it can operate entirely on layer 2).

continues to show a valid DHCP lease

This does not indicate that the CRS still has the IP assigned on its interface... What i would do is connect directly to the CRS either through MAC or Serial port and check Logs, DHCP client status etc...

Have you checked the lease time of the PFsense DHCP config? Could be the Mikrotik is receiving a different IP after the said period of time. Also check for loops in your connection.

Thanks for the feedback. I was able to fix this by changing my bridge "Protocol Mode" to RSTP.

I was able to fix this by changing my bridge "Protocol Mode" to RSTP.

That implies that you've got an Ethernet loop somewhere, since that's the only problem [R]STP solves.

I recommend you go find that loop and put RSTP out of a job for now.

Leave RSTP running so it can save you the next time it happens, though. This is very much a "don't shoot the messenger" sort of thing.

Thanks for the feedback. I was able to fix this by changing my bridge "Protocol Mode" to RSTP.

Something else is wrong in your Network, why RSTP was disabled ?
Have you checked all the logs for Loops ?