This is a re-hash of another question
http://www.experts-exchange.com/Networking/Network_Management/Network_Design_and_Methodology/Q_23388346.html

What exactly didn't you get from the other thread?

Personally, I would not do it the way you have it planned.
Some quick notes:
1. hubs don't do vlans. All phones should be on one single common vlan. You need vlan capable switches and trunk uplinks to the main switch. Change all instances of "hub" to "VLAN capable switch". Linksys makes some pretty reasonably priced ones that work with Cisco main switch
2. I would never use ISA as a firewall, especially for managed clients. I don't know how you plan to handle security for different vlans through the ISA. Does it do dot1q vlan trunking on the NIC?
3. I would use a Cisco ASA 5510 firewall appliance for all security requirements. It does do VLAN trunking and can controll all traffic from all vlans
4. VLAN's aren't setup by MAC address. Physical switch ports are configured into a VLAN. If you want dynamic VLAN assignment based on MAC address, that's a whole nother can of worms with a very expensive solution. Each office could have their own VLAN for data with a common Voice vlan.

Here's my shopping list:
Cisco ASA5510 firewall (just the base unit, no need for any of the fancy options)
Cisco 2960 10/100/1000 24 port primary switch in hub and spoke topology
Cisco 2960 10/100 8, 12 or 24 port access switches (hubs in your diagram), add PoE where it makes sense.