VLANS over VPN

what kind of tunnel? a site to site tunnel you pass everything through the trunk.

THe VLAns have to be defined on both sides i.e. the firewalls on each end will have the VLANS to which the switches are subordinated. then your segment to segment mapping.....

sounds as though you want the VLAns on the branch to inherit from HQ via the mere presence of the site to site VPN.

The VLANS have to exist on each side and the VPN will merely facilitate the data flow that then will be matched based on the routing rules you set
i.e. segment A in branch VLAN 12 will be allowed to pass to Segment 1 VLAN 12.

Sophos UTM has a RED (Remote Ethernet Device) functionality.
This allow VLANs at L2 transferred to the remote site.
Cisco should enable L2 connectivity too. But i don't know if VLANS are possible.

There are 2 descriptions for a tunnel... one is called Phase 1 (IKE) this is the key negotiation, the other is Phase 2 Tunnel, based on the Phase 1 key exchange.  Normally one can setup multiple Phase 2 specs to one Phase 1 key. and that way create multiple pipes in the same tunnel.
With each pipe their own endpoint. BTW, be advised that this can map a vlan on site one to a vlan on site 2, but it is Routed not switched.
Therefore the broadcast domains stay separated.

Use one of the following
Cisco – Joining Layer 2 Networks Over Layer 3 Networks

Pete

The easiest way is to use a layer 3 tunnel interface. both cisco and sonicwall can do this. you create a ipsec tunnel with a small subnet, normaly a /30 and route all vlans from one location to the other. dont forget to tell the routers/layer3 svi with routes the back.