Firmware upgrade Cisco 7911g via tftpd

I’ve been working on bringing some old cisco 7911G’s up to a recent sip firmware so they can be used with asterisk. Luckily the firmware is all available on the cisco site as long as you sign up for a free account.

If you’re running firmware older than 8.3 you need to update to a firmware level between 8.3 and 8.5.2 before you upgrade to firmware 9.x.

From the firmware 9.2 release notes:

"For all SCCP firmware upgrades from firmware release versions earlier than 8.3(3) to Version 9.2(3) or
  later, you must first upgrade your firmware to an intermediate Version (8.3(3) to 8.5(2)) and then
  upgrade to 9.2(3)."

To do the upgrade you need the a tftp server and option 66 defined on your dhcp to tell the phones where to look for the files. I’m doing this with a CentOS 6 server.

To force the upgrade I had to do the following:

Power off the phone.
Hold down the # key.
While holding #, connect an AC adaptor to the phone.
Continue to hold # until the line buttons blink amber.
Release the # key.
Enter 3491672850*#

Once you do that the phone is wiped and it reboots in search of new firmware. After obtaining an ip from DHCP (with option 66 pointing it to the tftp server) it will connect to the tftp server and start fetching firmware.

I had a problem where it was fetching the first few files but then generating a nak error on the tftpd server:

Apr 13 10:25:10 pbx in.tftpd[2732]: RRQ from 10.10.10.10 filename term11.default.loads
Apr 13 10:25:10 pbx in.tftpd[2733]: RRQ from 10.10.10.10 filename Jar11sip.8-2-2ES4.sbn
Apr 13 10:25:10 pbx in.tftpd[2733]: sending NAK (1, File not found) to 10.10.10.10
Apr 13 10:25:10 pbx in.tftpd[2734]: RRQ from 10.10.10.10 filename cnu11.8-2-2ES4.sbn
Apr 13 10:25:11 pbx in.tftpd[2734]: tftpd: read(ack): Connection refused


So it requests the first file but then dies on the Jar11sip.8-2-2ES4.sbn. Strange! After looking in the tftp folder I noticed that the file was there as expected. After some head scratching I ran strings against term11.default.loads which tells the phone what firmware files to download.

# strings term11.default.loads
# This file contains a list of archive image files that will be requested by the
# RELEASE load version 8-2-2ES4
#HARDWARE_COMP_1 1
Jar11sip.8-2-2ES4.sbn
cnu11.8-2-2ES4.sbn
apps11.8-2-2ES4.sbn
dsp11.8-2-2ES4.sbn
cvm11sip.8-2-2ES4.sbn
# ls
apps11.8-2-2ES4.sbn
cvm11sip.8-2-2ES4.sbn
jar11sip.8-2-2ES4.sbn
term06.default.loads
cnu11.8-2-2ES4.sbn
dsp11.8-2-2ES4.sbn
SIP11.8-2-2SR3S.loads
term11.default.loads


Ah! Linux is case sensitive so trying to download Jar11sip.8-2-2ES4.sbn isn’t going to work if the file on the server is jar11sip.8-2-2ES4.sbn. A quick rename of the file to Jar11sip.8-2-2ES4.sbn fixed the issue and the phone did it’s firmware update correctly. That seems like a bit of an oversight by the firmware release team at Cisco but maybe their Call Manager software runs a case insensitive tftpd.