In FreePBX 2.5.1.1 we introduced the ability to add a permit/deny based on ip addresses for SIP and IAX devices. When you add a permit, either the default 0.0.0.0/0.0.0.0 or set your own, it will show an A under ACL.
To set the default (or to set your own) go to Extension in FreePBX and select one of your extensions. You get a screen with two new fields called deny and permit. Default is all zeros, if you want to enter something here only change the permit and enter the network where your phone is.
Example, your phones are on the 192.168.22.x network, that network has a class C mask. In the permit field you enter 192.168.22.0/255.255.255.0.
After you save your changes, Asterisk will only accept register attempts from the 192.168.22.x network for that extension.
If you upgraded to FreePBX with Online Updates you get the permit/deny feature. BUT, you need to go through all extensions and save each of the to actually activate it. It is not done automatically.
If you have a problem with one extension it could be the phone that is to blame.
You need to provide more details, preferably a log/trace when the extension fails.