Here's a cheap, simple, and easy solution which uses routers that can act as SIP proxies:
Assume THREE DSL lines - Line 1 Internet, Line 2 Incoming calls, Line 3 Outgoing calls (if the Internet is on its own line, QoS is less of an issue)
Assume internal network uses 192.168.1.x addressing.
Existing Router
Two D-Link DIR 330 Wireless G VPN routers - $250 total cost - Fast CPU, lotsa RAM.
Open Source DD-WRT firmware - VOIP or Mega options - be sure to check the "Peacock thread" in the forums for reccomended builds.
Flash and D-Links with the DDWRT firmware.
Existing Router is unchanged - LAN IP of 192.168.1.1, DHCP enabled, DHCP default gateway of 192.168.1.1, other settings per your requirements
Router 2 with 192.168.1.2, DHCP DISABLED, Milkfish SIP proxy ENABLED (but no configuration beyond that), disable WiFi
Router 3 with 192.168.1.3, DHCP DISABLED, Milkfish SIP proxy ENABLED (but no configuration beyond that), disable WiFi
Attach each router to a DSL line, configure with public IP info.
Networked devices, including 3CX, are configured normally, with 192.168.1.1 as default gateway for internet traffic.
In 3CX configure two SIP Trunks for each provider. Trunk1 with 192.168.1.2 as the SIP proxy, Trunk2 with 192.168.1.3 as the SIP proxy.
Use 3CX's rules to pick Trunk1 or Trunk2 for outgoing calls. (So you can reroute quickly in a pinch)
Use your VOIP provider to pick the SIP credentials (of a pair) or Static IP (of a pair) to route incoming calls to
OR
Assign the incoming SIP credentials (account? different VOIP providers?) to one trunk, and outgoing ones to the other
OR
Under the Advanced tab in provider setup set one trunk to register for INCOMING calls, the other for OUTGOING. (Works with 1 set of credentials)
This has the effect of:
1) Regular internet traffice is isolated and cant interfere with calls (and vice versa)
2) 3CX web portal routed via regular internet connection
3) You can pick which of the phone DSL lines to accept and make calls on
4) It's a very "simple" set up, requiring only average networking skills. All the "routing" is done with wires, not complex firewall rules.
5) It's CHEAP! At $75-150 a pop for the D-Link boxes you aren't breaking the bank.
6) It's scalable! Just add more DSL lines and more Proxies!
Caveats -
There is no load balancing or autofailver. This is just manually routing things using wires and boxes instead of rules.
I haven't tested this. It SHOULD work. I am also new to 3CX, but fairly capable with networks.
I don't know how well the DDWRT/Milkfish proxy will handle remote extensions. If you can't just set each remote extension with DSL-A as the prinary SIP server and DSL-B as the secondary (reversed for half the remote extensions) and have it go, you might have to share DSL Line 1 between internet and remote phones or add a DSL line 4.
DSL should be able to handle 5-15 calls per line, depending on speed, and without other usage. It's all dependant on your upstream, as downstream is usually much higher.
You could certainly do the same thing with a good multi-WAN capable firewall, but it'd be a lot more complex, but possibly more secure (as one would expect a fancy firewall to have ALLLL the security bells and whistles.)