Upgrade a Cisco 7911 to SIP firmware

Recently I purchased a cheap Cisco 7911 phone off of Ebay. Now, we all know that Cisco doesn’t care about end users, and relies on product quality through their channel partners. If you didn’t buy it from a partner, then tough luck.

In this case, Ebay isn’t a partner, so I had to rely on a friend to download the latest SIP compliant firmware for the 7911 for me. The phone, as I had it, was configured to use Cisco’s SCCP ‘Skinny’ protocol, and talk to a CallManager server. I had other plans. A friend downloaded cmterm-7911_7906-sip.8-4-2.cop for me, which I promptly renamed to cmterm-7911_7906-sip.8-4-2.tar.gz. This allowed it to be ungzipped and untarred into a working directory called 7911.

Now, I already have a working tftp server on my network. I use it for all sorts of netbooting magic. For that reason, I’m not going to cover how to set up tftp, as that’s covered a million times over elsewhere on the internet.

The main task here, is to get the 7911 to load the term06.default.loads file from the tftp server. It would be nice if the 7911 would listen to the filename parameter that can be passed from DHCP, but sadly it seems to only be interested in term06.default.loads at the base of the tftp directory. I tried everything, from matching the hardware substring in dhcpd.conf, to symlinking the mac address to the right file. Ultimately, to keep everything tidy, I put the 7911 directory into my tftp boot directory, and ran the following command.

root@senior:/srv/tftp# for i in 7911/*; do ln -s $i . ; done
root@senior:/srv/tftp#

This runs through the contents of the 7911 directory, and symlinks them to the base tftp directory. Now, reset the phone with the following procedure.

With the phone turned off, press and hold # while inserting power, either via PoE or mains adaptor. In a second or so, the line buttons start flashing amber. Release # and dial 123456789*0# and then wait. Now is a good time to be running tail -f /var/log/syslog on your tftp server. All being well, you will see logs similar to that below. If this doesn’t work, or nothing appears on the phone display, wait 5 minutes and then try the procedure again, but use 3491672850*# instead.

Dec 29 19:49:16 senior atftpd[13059]: Serving term06.default.loads to 172.24.32.28:49152
Dec 29 19:49:17 senior atftpd[13059]: Serving jar11sip.8-4-1-23.sbn to 172.24.32.28:49153
Dec 29 19:49:20 senior atftpd[13059]: Serving cnu11.8-4-1-23.sbn to 172.24.32.28:49154
Dec 29 19:49:24 senior atftpd[13059]: Serving apps11.8-4-1-23.sbn to 172.24.32.28:49155
Dec 29 19:49:44 senior atftpd[13059]: Serving dsp11.8-4-1-23.sbn to 172.24.32.28:49156
Dec 29 19:49:47 senior atftpd[13059]: Serving cvm11sip.8-4-1-23.sbn to 172.24.32.28:49157

Once it has finished the last file, give the phone a couple of minutes to install and reboot. After a successful reboot, it should be display a Cisco screen with the words ‘Unprovisioned’ at the bottom left. If you continue to watch syslog, you will see that it requests XMLDefault.cnf.xml, CTLSEP001E4AF3D34A.tlv and SEP001E4AF3D34A.cnf.xml on a regular basis. These files handle the provisioning of the phone, from defaults to individual per-phone settings. Further information on the contents of such a file can be found over here. Once you’ve written the required file, save it into the working directory and symlink it to the tftproot as before.

You can then either wait for the phone to download the new file, or reboot the phone. Every time the phone boots, it will request term06.default.loads, as that informs it about the available firmware versions. If there are no changes, it will boot as normal.

22 comments

  • [...] read more | digg story [...]

    [WORDPRESS HASHCASH] The comment’s server IP (66.135.48.149) doesn’t match the comment’s URL host IP (72.233.2.59) and so is spam.

  • Greg Langford (1887 days)
    Hello,

    I have also bought a 7911G phone but do not have anyone with access to the firmware. I have managed to wipe the phone and now it has no firmware at all.

    Would it be possible for you to email me the SIP firmware file so that i can flash my phone?

    Thank you in advance.

    Kind Regards Greg Langford

  • Tom (1816 days)
    Ditto.

    It would be a great help if you could send the firmware on over to me. I don’t know anyone with access unfortunately and I got one cheaply off ebay.

    Not sure how old this post is!

  • Gonzalo (1809 days)
    Please can you send to my email this firmware? because I can’t download from cisco web.

    Thanks.

  • kyle (1809 days)
    Hi folks,

    I’d love to, but frankly there’s too many public requests now, and it’s illegal too. Sorry ’bout that.

    Kyle

  • Phil (1809 days)
    Any ideas how one can ‘obtain’ the sip firmware! As I too have some of these phones.

    Regards :)

  • kyle (1807 days)
    thepiratebay.org seems to have some cisco sip firmware and extras available.
  • Tom (1742 days)
    After giving up with this phone for a while, I decided to see if I could get it running.

    Having never worked with Cisco before I’m a little disappointed :(

    I’ve got a bit of a paperweight now – oh well, it was only a tenner off ebay.

  • kyle (1742 days)
    Have you tried a tftp server? What does the phone do and what do the logs say?
  • Tom (1741 days)
    Me? Yeah, but the file I got off of TPB didn’t have term06.default.loads. So I kinda reached a dead end!
  • kyle (1741 days)
    I’ve had a look around, and someone has posted up a bunch of links for SIP and SCCP firmware here http://certcollection.org/forum/archive/index.php/thread-19247.html

    Following the cmterm one takes you to a download page, and the file seems to have the right stuff in it. Might be worth a shot.

  • Tom (1740 days)
    Thanks for all your help, but I think I’ve got a brick now! ^_^

    When I key in 123456789*0#, the entire phone just turns itself off… strange.

    I think I’m in a bit over my depth. Thanks again – your blog makes a very interesting read, by the way :)

  • fasil kaks (1135 days)
    Hi,
    First let me appreciate for such a good document. :)

    I have a cisco 7911g phone to be converted from skinny to SIP.
    I have the downloaded firmware with me (version 9.2.1) and followed the exact same steps as above. The phone boots and I am getting the below tftp log
    “Serving term06.default.loads” to 192.168.1.201″ where 192.168.1.201 is my cisco 7911g phone.
    The above message is repeated with no further fetch from the tftp server.

    My network configuration:
    ————————————-
    My laptop ubuntu – DHCP server, TFPT server
    cisco home router WAG series – router
    DHCP server and TFPT servers are working good. Please find below their respective conf files:

    /etc/default/atftpd
    ————————–
    USE_INETD=false
    OPTIONS=”–tftpd-timeout 300 –retry-timeout 5 –mcast-port 1758 –mcast-addr 239.239.239.0-255 –mcast-ttl 1 –maxthread 100 –verbose=5 /tftpboot”

    /etc/dhcpd/dhcpd.conf
    ——————————–
    ddns-update-style none;

    option domain-name-servers 192.168.1.1;
    option tftp66 code 66 = string;
    default-lease-time 86400;
    max-lease-time 604800;

    authoritative;

    subnet 192.168.1.0 netmask 255.255.255.0 {
    range 192.168.1.200 192.168.1.229;
    option subnet-mask 255.255.255.0;
    option broadcast-address 192.168.1.255;
    option routers 192.168.1.1;
    option tftp66 “192.168.1.100″;
    }

    ————
    could you please let me know why the phone repeatedly fetches the term06.default.loads file and not proceeding with the remaining files? Thank you in advance.

    Fasil.

  • Angel Geraldo (1004 days)
    Hello,

    Could anybody let me know how to get this firmware.

    ageraldo [arroba] aiatek.com.do

    thanks.

    Angel

  • John (997 days)
    anyone have the latest sip firmware for a 7961 or a download site besides cisco?
  • JOYMAXICOMM NIGERIA LTD (955 days)
    Please we want the SIP ugrade of the Cisco CP-7911 to work in all IP PBX
  • David Cumbor (923 days)
    Just a note on the bricking comment.

    When i tried the 123456789*0# it was connecting to tftp server but hung on upgrading so i tried 3491672850*# and was met by a blank screen. From that moment on the phone seemed to be dead.

    After been very pissed off with my self i came back to my tail terminal 30 minutes later and even though the phone had a blank screen i noticed it was still trying to connect.

    My issues was a security config error in the tftpd and once that was resolve the phone came back to life with the new 9.2 firmware.

    I only commented as i was convinced i had bricked the phone.

    Thanks for the blog post btw made for an interesting afternoon.

  • ronnie (839 days)
    Hi, David, appreciate if you can share the step-by-step from the hardware connections, through TFTP server settings and the exact commands you run to load the firmware

    I am totally new to everything here

    cheers

  • Cem (669 days)
    i have gone crazy because of unable to load firmware for almost one week. Tons of thanks, pretty good work.
  • Gato (422 days)
    All OK. your a genius. i have unbrick and reflash 7911. Tftpd32.
    Thanks.
  • David (203 days)
    I have found when trying to reset the 7911G to factory this is the process:

    1. Unplug the phone from power (in my case PoE). Hold the # and then plug the power back in.

    2. Hold the button until you see the handset LED start flashing and then key in the 123456789*0#. You have about 60 seconds to make the entries.

    3. The handset LED will flash for only about 15 seconds and then stop.

    4. The phone is now reset!

    I am in the process of building a SailPBX/SME Server 8 system and the beauty of this is it doubles as a Server Gateway for the client. ;-)

  • David (200 days)

Leave a Reply

Your email address will not be published. Required fields are marked *

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>

Go to Top