Forgive me if this question is horribly misguided. I'm primarily a developer, but my company has asked me to work on setting up their network for data and voip connections in a sensible way (I do have at least a basic understanding of networking). We currently have two locations connected by a VPN. We are a video processing company so occasionally we need to move a large file across this line. We are planning on switching over our telephone system to a (remote) Asterisk-based system and want the ip phones to run on the same router/switches we have in place already. From what I've gathered, it seems to make sense to create 2 VLANs at each location -- one for data and one for phones -- and use QoS on the router to prioritize packets on the voip VLAN incase a huge video file is being moved across the VPN. Still, I want to allow computers on the data VLAN in location 1 to be able to "see" computers on the data VLAN in location 2. How might this be accomplished? I had thought that maybe having both locations under the same subnet might work, but it sounds like this is actually a bad (or impossible) idea? Any help or direction would be much appreciated.
You are correct in what you say.
You need to create a new vlan for VOIP at both sites. The VOIP lan at each site should not be the same vlan, or the same subnet. They ought to be routed between sites. You will need an extra interface on your router that is on the VOIP subnet (this can be a dot1q tagged interface if your router is capable of that). The new VOIP subnets will also need adding to the encryption domains of their respective routers.
I've never used a Linksys wan router but my gut feeling is that it won't be capable of doing QOS. I'm perfectly willing to be corrected there, but as a general rule I've found Linksys to be lacking when it comes to more sophisticated features - probably so they can sell more Cisco badged gear. But I digress.
The fact that your site to site link uses an IPSEC tunnel suggests that they are linked over the internet. With that being the case you will have to apply QOS to your internet traffic, and to your data traffic in order to prioritise VOIP.
The problem is you are not routing, add a router to the trunk in which all the vlan's you want to be able to communicate with eachother are present. Also add as default gateway your router.
If you want you can manage this with level 3 switches instead of having a seperate router and switch.
(Your VPN needs to be transparent, so if encryption happens at layer 2, this won't have an impact on my solution)
Remember here that your WAN connections will tend to be expensive and narrow. You want to play defense against sending unnecessary traffic through them.
With that in mind, you want a total of 4 vlans: separate voip and data at each site. This will keep broadcast traffic on either end from ever traversing your VPN link. Then you also need to make sure your router knows how to route both voip vlans between each other and to your remote asterisk, and also knows how to route both data lans to each other.
The really crucial part of your setup are not the VLANs (although they might help management matters), but the QoS for your VoIP traffic.
You should check with the router's docs what kind of QoS is done there. The switch port-based kind you describe is usually only used for ethernet-only QoS. Your main concern would be QoS over your VPN link, since even high-bandwidth transfers over the local network are really unlikely to deteriorate the voice stream quality for RTP. The VPN link on the other hand will give you high and varying (which is even worse than simply "high") latencies when congested, leading to dropped voice packets and thus significant audio signal distortion for your VoIP users.
You also should be aware that a simple claim of "QoS" will not necessarily give you the results you are wishing for. A VoIP transmission would typically need only little bandwidth (around 100 Kbps symmetric with G.711 / uncompressed), but the link should have a rather low RTT of < 150 ms at any given time. There are many QoS algorithms and implementations which are unable to achieve this in the field - you would have to benchmark yourself to see if your routers will be able to deliver.
Others already have commented on the routing issue - you will need to correctly set up the routing between your two VPN sites - once this is done, your hosts will be able to communicate with each other.