After several days of hard labour I managed to tame the beast. The Cisco IP-Phones of the 79×1 series supercede the 79×0 ones and have, besides a few lit buttons and a better, yet not backlit display a completely different firmware with much heavier restrictions.
Cisco IP-Phones are designed to work with Cisco’s own PBX named CCM (Cisco Call Manager) over Cisco’s own proprietary protocoll SCCP (or Skinny). While also the 79×1 Phones are advertised as SIP compatible, Cisco tries their best to make it increasingly difficult to even change the firmware of these phones to SIP without CCM. Many people will want this nice looking CTU-style device to behave as a standalone SIP phone independent of expensive Cisco pbx software which only runs on expensive Cisco certified hardware.
So here’s how to turn a 7941 or 7961 into a SIP phone without Call Manager:
1. Get the SIP Firmware
Cisco refuses to make the firmware available on the web like it does for the 79×0 series. Instead, Cisco asks to buy a SmartNet contract, costing some $50 or 40 Euro per year. However, if your phone is still quite new, your vendor can open a „Software Warranty Case“ with Cisco and an Engineer will make the files available for download to the vendor. Most vendors or distributors are not aware of this, it took me an hour of conference calls with Ingram and Cisco. If you look hard enough, you might even find the firmware somewhere on the web. The firmware file for models 7941 and 7961 seems to be identical.
2. Prepare the environment
When the phone is powered up, it aqcuires a DHCP-lease and looks for a TFTP-Server to boot from. Run the two somewhere, there are free programs for Windows, get dhcpd or dhcp3-server and atftpd on GNU/Linux.
3. Prepare files
Cisco uses extension .cop for their firmware files, probably just to confuse people. They are however plain .tar.gz and are expanded with the usual winrar or tar xfz. The resulting files must be put into the TFTP-server’s directory.
Three extra files are not part of the firmware image and must be prepared: „XMLDefault.cnf.xml“ can be an empty textfile or even omitted, I didn’t try that. The second and third file must be named after the phone’s hostname. Boot it up normally, let it aqcuire a DHCP-lease and call that IP address in your browser to find out that hostname.
CTL[mac address]. again can be a completely empty text file or omitted, I did omit this one. This file is meant to validate the firmware against Call Manager and – when utilized by Cisco in the future – will make it completely impossible to change firmware without CCM.
The third and important file, SEP[mac address].cnf.xml contains the phone’s configuration and is well documented here. Edit until tender. The above document btw contains many of the information compiled here, just spread out a lot more.
4. Connect the phone, power it up and carefully watch the output or log of the TFTP-Server (i.e. tail -f /var/log/syslog). The phone will request files that might be spelled differently in the downloaded package. As GNU/Linux tends to be case sensitive the exact spelling is paramount.
5. If the phone picks up the configuration but does not upgrade the firmware, try resetting it as follows: Press and hold # while powering it up with the ac adapter (not with PoE). When the line buttons start flashing amber release # and dial 123456789*0#. The phone will reboot and load the new firmware. If this doesn’t work, try 3491672850*#.
Again, carefully watch what files are requested and which are actually there in TFTP. If all goes well, there will be nice looking output on the display, showing various downloads and system prompts. When that is finished, the phone should be a compliant SIP phone ready to be used with any SIP compatible service or PBX such as the lovely asterisk.
6. The [hostname].cnf.xml file will have to be tweaked a lot. To reload this file press the settings button followed by **#**. To monitor settings, the phone can be SSHed into using the credentials set in the config file followed by L/P debug / debug on the 2nd login (very tricky). In newer asterisk versions, the option buggymwi=yes can be added to the phone’s configuration in sip.conf to make the nice red „message waiting indication“ (MWI) on the receiver work. To add custom ringtones make or download a .raw file and put a file named ringlist.xml and one named distinctiveringlist.xml into tftp, google for ringlist.xml for the format. The former has default tones, the latter special tones for the user. The phone won’t load new ringtones on boot but after settings – ringtones is selected.