Filter rules by MAC on ASA 5506?

[cknowlton]

Hello! 

I have a client with an ASA 5506 and next week they have an employee taking their IP phone home to setup working from home. As far as I know right now, till we get more info on the home network, it's DHCP for the public IP, not static. 

I need to allow traffic to the public IP inbound at the office to certain ports for the phone to register, connect to the phone system, etc. Trying to find out, is it possible to allow the user's modem's MAC address in the rules? I don't see that option but trying to avoid opening up rules to the public if I don't have a static IP at the employee's house where the phone will be setup. 

thanks!!

[Marvin Rhoads]

The MAC address is only locally significant and does not generally convey across the WAN.

Typically we have remote "Sites" such as this establish a site-site VPN over which corporate traffic is carried. You can do that with remote site having a dynamically assigned IP address but, if there are multiple ones, each would require a unique internal address space. Historically we also did this with AnyConnect phone setup but that's mostly been deprecated these days.

The other option that's much more commonly used these days is using a VoIP solution like WebEx calling to an Expressway CUCM server at the corporate office end.