On the switches, configure a second VLAN for voice, such as VLAN 2. Enable LLDP on the switches and identify the voice VLAN on the interfaces. Configure one access port on the switch for native VLAN 1 and connect that to your Sophos. Configure a second access port on the voice VLAN and connect that to your 3448.