Pfsense multi-site VPN VOIP deployment

pfSense has all of that and more, plus you can scale up to whatever hardware you need: from a simple, 500MHz ALIX-based platform from PCEngines.ch (3 NICs as well, less than $300 all told with PSU, enclosure, and CompactFlash for storage), up to an Axiomtek barebones network appliance with 6 GbE interfaces, Intel Dual Core chipset, 2 GB DDR2 RAM, etc. for growth down the road.

You're not going to find a commercial/SMB firewall that can do as much as you can by building your own pfSense box, and all you're paying for is the hardware you need and (optionally) commercial support (although they have a great book out and the community is excellent).

I have it deployed at close to a dozen clients now, some with simple firewalling/NAT, others with multiple IPsec tunnels, multi-WAN, DMZ, CARP, etc. etc.

A lot of this depends on the bandwidth that your phone system is going to use - if it's a call center with hundreds of people on the phone simultaneously you'll have a higher need for a separate network than an office of hundreds who just want phones on their desks but aren't heavy users. A conservative (as in, "way more than is really used") estimate is 128kbps per simultaneous call, or 8 calls per megabit, so gigE can do approximately 8000 simultaneous calls (okay, a little less due to overhead, but that's the right order of magnitude). So it's unlikely to be a bottleneck. And as long as you have QoS so that big downloads won't affect your phone traffic you should be fine.

Something you don't address is the Power Over Ethernet (PoE) angle - PoE switches are a significantly more expensive (both to buy and to run) than their non-PoE counterparts. One nice feature of PoE is that a single UPS on the switch keeps all the phones running during a power outage.

What I've done in the past is: run a PoE and a non-PoE port to everyone's desk. The PoE is labeled 'Phone', the non-PoE is 'data'. This preserves data speeds for the user's computer, gets the aforementioned power redundancy for the phone, and allows me to (eventually, if needed) separate out the networks more.

So I guess what I'm saying is: don't bother with 'software' non-convergence, but do bother with separate networks where the hardware matters. If the hardware's going to be the same though (ie. you're running all PoE or all-non-PoE switches) then a converged network should be fine.