I guess rabjac needs a Lan->Lan VPN ( rather than just a single PC ) to handle the IP Phone. You should ( although I've not tried it ) be able to establish a Lan->Lan IPSec VPN where one end has a dynamic IP. Your contractor will need to get a dyndns ( or similar ) account and then you should be able to configure your corporate VPN server with his dyndns domain name instead of the static IP. The only other change you should need to make is to configure the IKE phase 1 mode from 'main' to 'aggressive' ( on both ends ) to handle the dynamic IP. Oh, and you will need to initiate the VPN from the contractors end ( if you don't already ).
Hope that helps.

Hi candl, your absolutely correct. The only problem - our corporate firewall works with IP addresses only, not domain names that would be used via dyndns.

In that case why don't you just pay the contractor to cover the increased cost for his static IP, got to be the simplest ( and most cost effective! ) solution.