Cisco 7940 7960 Single Step Upgrade


Yes, its another page about how to make these darned phones update to the lastest firmware, I've come up with a solution that has worked well for me so far, I dont know how anyone else will fair, but it allows the phones to completely update from old cisco images to the latest sip images. This may be useful to you if you have a lot of phones to manage. I was finding it damn annoying having to continually rename and edit files till I had some sucess with each phone, over and over again.

I've used the DHCP3 server to detect what state the phone is in, be it an older firmware or in the universal upgrade image or in the sip firmware itself to determine what set of files to present to the server to simulate each step in the configuration changes.

If the firmware is an old cisco one, it will announce itself as "Cisco Systems, Inc. IP Phone" (with a null byte), so we can tell that phone to use a different tftp server, and present to it the XMLDefault.cnf.xml pointing to the universal application loader. If a modern sip image saw this file it would want to be in skinny mode and get upset, so this technique hides it. If the image is very old, the OS79XX.txt would make it upgrade to a slightly newer one, I had a phone with an image that wouldnt try to receive the XMLDefault.cnf.xml file, just SEPDefault.cnf over and over, fixing the OS79XX.txt helped here.

Once the universal application loader is installed, the vendor string announced to dhcp changes to "Cisco Systems, Inc. IP Phone CP-7940G(null byte)", so we dont want to serve the old cisco image anymore, we can point the phone at the SIPDefault.cnf and then the new application firmware.

Disclaimer This may all be totall bull, but its worked for me.

I'd like to sort out this null byte dhcp nonsense, but substring on the vendor identifier matches both versions of the string as one is the prefix of the other.

I'd also like to verify the image files I've used here are named correctly. Its weird I may have a sccp image with a sip filename, I don't know what provoked me to do that, I'm going to try changing these to the correct names and updating this site.

You will need

1. A good dhcp server, i've used dhcp3-server from debian sarge

2. A tftp server NOT launched from inetd - i've used atftpd with good success

3. Firmware files
SIP 7.4 Image Files - P003-07-4-00.bin P0S3-07-4-00.loads P0S3-07-4-00.sb2
SIP/SCCP Image 6.3 - P0S30603.bin - I've maybe mixed this up I'm using a file with MD5SUM 8fdf5f36c444365ee6cda414b83b427d (P00306000400.bin perhaps, someone correct me)

4. A Machine with two IP addresses, or two tftp servers on different machines if you wish, adapt this guide as appropriate.

Network configuration

I've configured the machine with two IP addresses, In my case and as ip aliases on the same interface card, use what you wish, and update the configuration appropriately.

NOTE: My Cisco 7940, new out of the box, was trying to resolve an address
CiscoCM1.<mydomain>. It was trying to use this address as its TFTP server. Since I was
using dnsmasq, adding the following line was enough to trick the phone into using my local TFTP server:

Where x.x.x.x is the address of your TFTP server.

DHCP3 Configuration

You may adapt this to give different IP address ranges to differnt models of phone fairly easily, which can be useful.

NOTE: #You can use the following command to catch your devices vendor-class-identifier when it is doing it's dhcp discover:
tcpdump -lenx -s 1500 port bootps or port bootpc > tcpdump-dhcpd-output.log


ddns-update-style none;

option domain-name "";
option domain-name-servers;

default-lease-time 600;
max-lease-time 7200;


log-facility local7;

class "cisco7940"
match if substring (option vendor-class-identifier,0,36) = "Cisco Systems, Inc. IP Phone CP-7940"; #<----Matches first 36 characters
option tftp-server-name "";

class "cisco7960"
match if substring (option vendor-class-identifier,0,36) = "Cisco Systems, Inc. IP Phone CP-7960";
option tftp-server-name "";

class "polycom" #<----Polycom matching not tested yet, provided here for example only
match if substring (option vendor-class-identifier,0,36) = "Polycom";
option tftp-server-name "";

subnet netmask {
option subnet-mask;
option broadcast-address;
option routers;
option domain-name-servers;
pool {
allow members of "polycom";
pool {
allow members of "cisco7940";
allow members of "cisco7960";


NOTE: The above substring match option for different models works. If you have the exact vendor-class-identifier strings for VoIP devices hardware, please list them.

Atftp configuration


OPTIONS="--daemon --port 69 --tftpd-timeout 300 --retry-timeout 5 --mcast-port 1758 --mcast-addr --mcast-ttl 1
--maxthread 100 --verbose=5"



case "$1" in
echo -n "Starting $DESC: "
start-stop-daemon --start --oknodo --quiet -p /var/lock/tftp.cisco_sip --exec $DAEMON — $OPTIONS --bind-address --pidfile /var/lock/tftp.cisco_sip /tftp/cisco_sip
start-stop-daemon --start --oknodo --quiet -p /var/lock/tftp.cisco_upgrade --exec $DAEMON — $OPTIONS --bind-address --pidfile /var/lock/tftp.cisco_upgrade /tftp/cisco_upgrade
echo "$NAME."
echo -n "Stopping $DESC: "
start-stop-daemon --stop --oknodo --quiet -p /var/lock/tftp.cisco_sip
start-stop-daemon --stop --oknodo --quiet -p /var/lock/tftp.cisco_upgrade
echo "$NAME."
$0 stop
$0 start




/tftp/cisco_upgrade/XMLDefault.cnf.xml AND
<member priority="0">
<loadInformation6 model="IP Phone 7910"></loadInformation6>
<loadInformation124 model="Addon 7914"></loadInformation124>
<loadInformation9 model="IP Phone 7935"></loadInformation9>
<loadInformation8 model="IP Phone 7940">P003-07-4-00</loadInformation8>
<loadInformation7 model="IP Phone 7960">P003-07-4-00</loadInformation7>
<loadInformation20000 model="IP Phone 7905"></loadInformation20000>
<loadInformation30008 model="IP Phone 7902"></loadInformation30008>
<loadInformation30007 model="IP Phone 7912"></loadInformation30007>

/tftp/cisco_upgrade/P003-07-4-00.bin MD5SUM:69ce9c2130d227ae9659c4cd7dc0fddd
/tftp/cisco_upgrade/P0S30603.bin MD5SUM:8fdf5f36c444365ee6cda414b83b427d

/tftp/cisco_sip/P0S3-07-4-00.loads MD5SUM:1b2086774bad081b0b0b51d4ea07a270
/tftp/cisco_sip/P0S3-07-4-00.sb2 MD5SUM:18f9a009daf6c946087910a354a4be75

As described in Cisco Mass Deployment
image_version: P0S3-07-4-00
sntp_mode: anycast
etc etc

As described in Cisco Mass Deployment

Created by: darkskiez, Last modification: Sat 25 of Apr, 2009 (03:10 UTC) by eriklat
Please update this page with new information, just login and click on the "Edit" or "Discussion" tab. Get a free login here: Register Thanks! - Find us on Google+