If you have an ASA, you can use it as a phone proxy, or use it to set up a phone VPN
http://www.cisco.com/c/en/us/td/docs/security/asa/asa82/configuration/guide/config/unified_comm_phoneproxy.html#wp1144845
http://www.cisco.com/c/en/us/support/docs/unified-communications/unified-communications-manager-callmanager/115785-anyconnect-vpn-00.html
If you have Jabber, you could implement Expressway so that you can register a softphone through to your CUCM on a public IP address, though this will not work for a physical endpoint (though I believe it's roadmapped).