STEP 1: Download The Cisco Phone Firmware: How To Recover Cisco 7961 With SCCP

Download as pdf or txt
Download as pdf or txt
You are on page 1of 5

How to recover Cisco 7961 with SCCP

created by: Rainer Bemsel – Version 1.0 – Dated: NOV/19/2011

The purpose of this document is to provide a set of instructions about how to recover a Cisco phone and load
SCCP Software. You do not need to have a Cisco Call Manager to run the recovery process.

There are several entries in different forums about that topic, but all I’ve consulted seem to miss a piece of
the whole challenge.

First of all, you need to be very patient during that process. Even you think the phone is “dead”. In Reality,
the phone is requesting DHCP Address (if not set to permanent) followed by TFTP File requests.

STEP 1: Download the Cisco Phone Firmware

Go to www.cisco.com/go/software and find the right phone firmware. You will need to have a support
contract before you can download the firmware. There are other resources on the internet were you can get
those files as well.

I was using 8.3 (3) to have a compatible version for upgrading with my Cisco Call Manager 8.x after
registration. There is another TechTip telling about that issue “Authentication Fail when register with
CUCM”

Make sure you download the zip-file, as this is the best choice to upgrade outside of Call Manager.
How to recover Cisco 7961 with SCCP
page 2 of 5

STEP 2: Prepare your PC or Laptop to support the Upgrade

Freeware Tools, I have used:


a) TFTP Server to provide the firmware loads
http://tftpd32.jounin.net/

Note:This version seems to be best fit and most likely smart and smooth working

b) WinDump to see packets coming in


http://www.winpcap.org/windump/default.htm

c) Observer (not a freeware) or Wireshark to packet analyze firmware load


http://www.networkinstruments.com/products/observer/expert.html

STEP 3: Install TFTP Server and make adjustments


The installation is simple forward. Just run the executable. After installation, place the extracted files in
the upload directory of your choice.

XMLDefault.cnf.xml is not part of the Firmware Package.

You need create a new file or download from here: http://www.bemsel.com/tools/HelpFiles/XMLDefault.cnf.xml


How to recover Cisco 7961 with SCCP
page 3 of 5
STEP 4: Create Default XML File and configure for proper firmware load

The loadInformation needs to be exactly the LOADS file from your firmware tftp upload directory

STEP 5: Configure DHCP Server if required

DHCP Option 150 – see also next page


http://www.iana.org/assignments/bootp-dhcp-parameters/bootp-dhcp-parameters.xml

Cisco Phone to load SCCP required TFTP Server Address; this is what Option 150 provides for DHCP
Requests. This needs to be provided by HEX in Reverse
How to recover Cisco 7961 with SCCP
page 4 of 5
You can use the Programmer Calculator of Windows, or any other online tool. All you need to do is to convert
each Byte of the IP Address and put in reverse into the option value

192.168.10.105 -> 105.10.168.192 -> 0x69AA8C0


192.168.1.1 ->1.1.168.192 -> 0x0101A8C0

STEP 6: Reset Cisco Phone 7961

1. Pull power on the phone (even if power is PoE).


2. Hold down the # key on the phone.
3. Continue holding down the # key and re-apply power
4. While still holding the # key wait for the Message Waiting Indicator (MWI) light on the handset to
start flashing amber.
5. Once the MWI light is flashing amber, release the # key and enter the following sequence exactly on
the keypad: 3491672850*#
6. The amber lights are turning red. That’s when the phone deletes configuration and firmware.
7. It will reboot and tries to get an IP Address via DHCP. Option 150 does the Auto-Provision the TFTP
Server IP Address

For more DHCP options: http://www.iana.org/assignments/bootp-dhcp-parameters/bootp-dhcp-parameters.xml


How to recover Cisco 7961 with SCCP
page 5 of 5
A few troubleshooting points.

Once this sequence has been entered on the IP Phone, if all the network criteria above have been met, it
should begin its recovery process. This process can take up to 15 minutes to finish. The phone may appear to
be doing nothing during this time. However, if the phone does not recover after 20 minutes then it is
possible that the recovery is stuck. In this case, re-examine your network and verify that steps 1-4 are in
place, and then re-issue the factory reset sequence.

During my troubleshooting experience, I spanned the Phone Port to a packet analyzer to see what’s going on
the wire.

Remember the XMLDefault.cnf.xml file, you modified in Step 4.

Don’t be afraid to re-run that procedure in the case, if you think it didn’t finished successfully. I did it
several times in the first place.

Note: The factory reset sequence is a way for a phone to clear flash and still upload to a valid firmware
image. This is facilitated by the termxx.default.loads file, but requires that the image files listed in the
termxx.default.loads file are available in TFTP for the phone to download. Open the termxx.default.loads
file in any text editor. This loads file is essentially just a packing list showing all the OS and application files
the phone needs to function. The files include a cnu, cvm, dsp, app and jar files. Please make sure that these
files as listed in the termxx.default.loads file are in TFTP. ("xx" will be either "41" for the CP-7941 model,
or "61" for the CP-7961 model.)

You might also like