Here is a method I’ve found to recover a Cisco IP phone that’s indefinitely bootlooping. In my case, it was a Cisco 7945 that when plugged in showed the initial splash and loading screens, but never reached the standard blue ‘desktop’ screen to register. It turned out that the firmware on the phone was so out of date that the Call Manager server wasn’t able to update it. To fix it, I set up a DHCP and FTP server on my laptop in order to step through the firmware upgrade path for the phone and get it on a firmware version that the CUCM server could work with. Standard disclaimer – do this at your own risk; I’m by no means a phone system expert.
Getting the XML config
I used tftpd32 for this since it has a TFTP client, TFTP server, and DHCP server in one program. Unfortunately it had/has some issues running on Windows 10, which I’ll go through later. I had to run tftpd32 as admin every time in order for it to work properly. Remember to disconnect from your main network so you don’t accidentally stand up a rogue DHCP server. The first thing we need to do is grab an .xml file from the CUCM server, since we’ll be using it to set up a pseudo-CUCM server on the laptop. Start tftpd32 and go to Settings > GLOBAL, turn off everything except TFTP client, and then restart the program. Plug back into your network and then use the TFTP client to connect to your CUCM server – the default port for TFTP on it is 6970. The remote file we need to Get is xmldefault.cnf.xml.
Finding the current firmware version
Next we need to find out which firmware the phone is currently looking for so we know what our starting point is. Disconnect from your network, and then give your computer an IP address of 193.0.0.0 with a mask of 224.0.0.0. This weird configuration is a consequence of one of the Windows 10 quirks that tftpd has – it was changing the DHCP option it was sending to have the last 3 octets set to 0 (e.g. 192.168.1.1 would become 192.0.0.0), so I just came up with a subnet where I could have an x.0.0.0 address assigned to a host. start up tftpd with the DHCP server and TFTP server turned on. Start up tftpd and turn on the DHCP server and TFTP server. The the DHCP settings, set the pool to 193.0.0.10, mask to 224.0.0.0, pool size 10, and default route 193.0.0.0. Change the Additional option to have 150 in the first box, and “i 193.0.0.0” without quotes in the second. This is another quirk – without the lowercase “i”, the option will be sent in a different format (I believe as a string instead of an integer). DHCP Option 150 is what tells the phone where to look for the CUCM server – in this case it will be your computer. Plug the computer into a switch, and then the phone. This will need to be a PoE-enabled switch unless you have a separate power adapter for the phone. The phone will then boot, get its DHCP settings from your computer, and ask your TFTP server for a file. In the Log Viewer tab of tftpd, you should be able to see what firmware it’s looking for. You’re looking for a version number – if you see something like “SCCP45.8-3-3”, the numbers toward the end are what you need. In this case, it translates to 8.3(3). Once you get this number you can unplug the phone. If you’re having any trouble with the phone connecting, you can use Wireshark to see exactly what’s being sent by the phone and computer and troubleshoot from there.
Downloading the necessary firmware
For this, you need to know the firmware version you want the phone to end up with. If you don’t know, open up the XML file you downloaded earlier and search for the model of phone you have (i.e. 7945). You’ll see a number like SCCP45.9-4-2SR3-1S, which is version 9.4.2(1). The format of the name changes slightly depending on the model and version, so you might have to look it up. This version is what your server is currently serving up to that model of phone. Use Google to find the release notes for that version. The notes should have an upgrade path listed, and you’ll want to find the path to upgrade from the phones current version to the new one. In my case, it was 8.3(3) to 8.5(2) to 9.3(1) to 9.4.2(1). Go onto Cisco’s download center (you’ll need a valid login) and download each of the firmware ZIP files in the upgrade path. Create a folder on your hard drive to use for the TFTP server – I used C:\cmterm. Open the oldest firmware ZIP file and copy the .sbn and .loads file to C:\cmterm. Copy the xmldefault.cnf.xml file from earlier into the same folder. Edit the XML file – search for the phone model and change the load information in the middle of the XML tags to match the .loads file name. It’s easiest to just copy the name of the .loads file without the extension and paste it in here. Open tftpd and set the home directory for the TFTP server to the cmterm folder.
Updating the phone
Once the firmware and xml file are in the TFTP home directory, you can plug in the phone. If all goes well, it will get the proper DHCP settings, connect to the TFTP server, download and install the firmware, and reboot. Sometimes it will reboot multiple times, but eventually it should reach the default screen where it says ‘Registering…’. Once it says that, you can unplug the phone. Copy the .loads and .sbn files for the next version in the upgrade path into the cmterm folder and get rid of the old ones. Edit the xml file to match the new ones, then connect the phone and install. Keep repeating this process until the phone is on the version that matches what’s on the CUCM server. Once it gets to this point, you can connect it up to your main network and hopefully have a fully functioning phone!
Side Notes
Don’t connect phone back to main network until it’s on the latest firmware. If it grabs the CUCM IP address, it will ignore the TFTP server and you’ll have to wipe the phone. To wipe the phone in case of mistakes – Unplug the phone, then hold down # while plugging it in. Wait for orange lights to blink back and forth. Release #, then press 123456789*0#. Leave phone plugged in for a few minutes before starting again. You’ll have to start from scratch at the oldest firmware.