Cisco 9951 never registers extension

FreePBX Endpoints
1

I have a Cisco 9951 phone I am attempting to get registered with my system but it never sends the registration request.

Here is my SEP(MAC).cnf.xml file:

<?xml version="1.0" encoding="UTF-8"?>
<device>
  <deviceProtocol>SIP</deviceProtocol>
  <loadInformation>sip9951.9-3-2-10</loadInformation>
  <sipProfile>
    <sipLines>
      <line button="1">
        <featureLabel>Basement</featureLabel>
        <displayName>Basement</displayName>
        <name>1</name>
        <authName>1</authName>
        <authPassword>secret from pbx extensions tab</authPassword>
      </line>
    </sipLines>
    <sipPort>5060</sipPort>
    <sipProxy>192.168.20.41</sipProxy>
    <sipRegistrar>192.168.20.41</sipRegistrar>
    <registerWithProxy>true</registerWithProxy>
  </sipProfile>
</device>

I setup the TFTP server with this file and a blank CTLSEP(MAC).tlv and an ITLSEP(MAC).tlv file and can see the network requests from the phone attempt to get the files

Nov 11 12:17:54 pbx in.tftpd[146603]: RRQ from 192.168.20.38 filename CTLSEP(MAC).tlv
Nov 11 12:17:54 pbx in.tftpd[146604]: RRQ from 192.168.20.38 filename ITLSEP(MAC).tlv
Nov 11 12:17:54 pbx in.tftpd[146605]: RRQ from 192.168.20.38 filename SEP(MAC).cnf.xml

I see a status message on the phone under Administrator settings that just says SEP(MAC).cnf.xml (TFTP) every few minutes, so it seems the phone is continually trying to get these files and then failing somewhere.

I have monitored asterisk with sudo asterisk -rvvv and setting my debug level to 5 but never see a registration event logged which makes me think there is some kind of issue with the config file even though I have parsed it and tried multiple variations. I can see the extension in the system when running pjsip show endpoints:

Endpoint:  1/1 Unavailable   0 of inf
InAuth:  1-auth/1
Aor:  1  1
Objects found: 1

I can see the firmware on the phone is listed as sip9951.9-3-2-10 which makes me believe that I should be using the SIP configuration as opposed to SCCP like I saw here: Cisco 9951 Phones

I’m unable to see any more detailed logging from the phone as to whats going on, any suggestions for what I can do to debug or get this thing registered?

2

Based on the thoroughness of your post, you have experience and I am assuming this isn’t the first time you’re doing this as. As such I am assuming that you know that Cisco phones are very particular with their requirements.

Has the phone been reset to default (NOT factory reset) by dialing 123456789*0# upon startup?
Is the phone expecting a signed/secure version of the files?
have you checked which security mode the phone is configured to use?
On my 7965 it’s under “Settings” → “8 Security Configuration“ → “5 Security Mode“
Those are the first things that come to mind.

Obviously the phone finds the tftp server so the first hurdle is passed. That always took me friggin ages…

Try providing a default configuration using the CTLSEP.tlv and CTLSEP.tlv files?

With Cisco phones I’ve only ever used SCCP instead of SIP. As such I’m curious to see how this thread progresses :slight_smile: .

Edit: turn on the web server of the phone to get access to additional logs.

Edit: Why is the SIP Registrar and the SIP Proxy the same IP? That seems counterintuitive. What happens when you remove the Proxy config from the SepMac file?

3

Thanks for your reply! This is my first time doing this but I have spent a LONG time researching what could be going on…

  • dialing 123456789*0# on startup didn’t seem to do anything, I tried a few different places in the startup sequence
  • when I checked the security mode it is just set to Non-seure, is there a good way to find default config for the CTLSEP.tlv and CTLSEP.tlv files?
  • I don’t see a way to turn on the web server on the phone at all, is this something that is usually available?
  • a lot of articles I have seen about cisco phones in general seem to say they use SCCP over SIP as well, my phone’s firmware is just titled “sip9951.9-3-2-10” on the main settings screen so I’m assuming I need to be doing all this through SIP but maybe not

I also found an interesting website about patching asterisk https://usecallmanager.nz/patching-asterisk.html that provides a way to patch and use a built from source version of asterisk that fixes some issues with cisco phones. I tried this version of asterisk just to see if it would help but it doesn’t seem like it does, phone still doesn’t register.

4

You’re in for a ride…
To reset the phone to the installed firmware’s default (read that part a couple times until it sinks in…) powercycle it, and hold asterisk key until the lights blink in a pattern, then enter 123456789*0# and it should reset. At least that used to be the reset code for the longest time.

If you look online there’s also a way to factory reset your phone and purge the firmware entirely. This means you have go through the complete upgrade cycle until you reach your desired firmware version. Do not do this. It’s easier to grab a few ethernet cables, bind them together and self flaggelate because that cuts out the middle and gets you right to the pain.

The default SEPMAC config is use case specific. In essence you want to provide the minimal requirements to deploy phones in a large company where you can’t simply go to the employee’s desk and to configure things there because you have to do the same thing 500 times and it takes ages. To save the legwork you provide a minimal functioning config and the remaining details can be provided remotely.
-That being said, lookup the SEPMAC manual where the variables and options are explained. I haven’t mine ready at the moment so give me some time to look for it.

The webserver is turned on via the SEPMAC file. I see now where I went wrong. :sweat_smile:

The thing about Cisco phones is that some of them work rudimentarily with SIP but the full feature set is only available via SCCP.

To run it with FreePBX and SCCp refer to GitHub - chan-sccp/sccp_manager: SCCP Manager

If Cisco changed its mind and went SIP it wouldn’t matter in your case as you’re using legacy hardware to which the protective stance of Cisco and it IP still applies.

Personally I would be surprised if they went hardware SIP as physical devices become less prominent in a world of remote working.

Can you get more logs from the tftp server instead of asterisk? I reckon that’s where it’s at at the moment as asterisk only comes into play after the provisioning.

Edit: the link you provided from usecallmanager.nz is the most potent resource in your arsenal at the moment.

Check out SEPMAC.cnf.xml and refer to the HTTP provisioning contents that is provided. There’s a smaple SEPMAC file in there.
On the page itself, there’s an extensive list of options and a description of them.

Edit Edit: create an image of your freePBX harddrive for easier restoring. You’ll thank yourself later…

5

Still not able to register the phone but I think I made progress?

New SEP config I am using is below, as soon as I updated it to this I saw that the phone started to request two new files from me that it wasn’t able to find: lk-sip.jar and g4-tones.xml.

I found what may or may not be a completely incorrect version of those files here: Index of /Cisco/IOS/IP Phones/7942G/English but am pretty skeptical because it doesn’t explicitly say these files are for 99XX variants…

When I added these files to the TFTP directory, the phone got them and then it looked like it rebooted, then just showed me the home screen again with “Phone not registered” on it. Status page of the phone now says “VPN Error: VPN not configured” so not sure what that is about yet.

I also found an interesting post from a long time ago here: Cisco 9971 phone configuration working example with setup tips - #47 by troy_orndoff

This person seemed to have the same problem I am encountering but said that you can get more info by accessing the web server on the phone (which for some reason I am still unable to do even when trying to include the setup in my SEP config).

<device>
  <deviceProtocol>SIP</deviceProtocol>
  <loadInformation>sip9951.9-3-2-10</loadInformation>
  <devicePool>
    <dateTimeSetting>
      <dateTemplate>D/M/Y</dateTemplate>
      <timeZone>GMT</timeZone>
    </dateTimeSetting>
    <callManagerGroup>
      <members>
        <member priority="0">
          <callManager>
            <ports>
              <sipPort>5060</sipPort>
            </ports>
            <processNodeName>192.168.20.44</processNodeName>
          </callManager>
        </member>
      </members>
    </callManagerGroup>
  </devicePool>

  <sipProfile>
    <sipProxies>
      <backupProxy></backupProxy>
      <backupProxyPort></backupProxyPort>
      <emergencyProxy></emergencyProxy>
      <emergencyProxyPort></emergencyProxyPort>
      <outboundProxy></outboundProxy>
      <outboundProxyPort></outboundProxyPort>
      <registerWithProxy>true</registerWithProxy>
    </sipProxies>

    <sipLines>
      <line button="1">
        <featureID>9</featureID>
        <featureLabel>Room</featureLabel>
        <proxy>192.168.20.44</proxy>
        <port>5060</port>
        <name>1</name> <!-- extension -->
        <displayName>Room</displayName>
        <authName>1</authName>
        <authPassword>pass</authPassword>
        <messagesNumber>*97</messagesNumber>
      </line>
    </sipLines>

    <preferredCodec>g711ulaw</preferredCodec>
    <natEnabled>false</natEnabled>
    <phoneLabel>Room</phoneLabel>
    <userInfo>1</userInfo>
  </sipProfile>
</device>
6

:+1: congrats on your progress. When looking for Firmware, be especially cautious as there’s versions that lack the correct signature or are incomplete and can brick your device. Open your current one with a text editor and you should be able to get a glimpse. However, I don’t know of a way to manually confirm validity.

“VPN Error: VPN not configured” means that the phone is setup to expect a VPN configuration so it can connect to a VPN server and take it from there. Either reset your phone to firmware default or exclude VPN in the SEPMAC file. Check your SEPMAC command reference for that.

”Phone not registered” indicates that the phone has not been able to successfully connect to your FreePBX server and talk to it. Check the asterisk logs again and see if you can find something.

For the sake of being thorough:
As you are able to access the settings. Lookup the phone’s IP address and enter it in your web browser’s address bar, that’s where you get the logs once the webserver is “enabled”
In the provided SEPMAC file, “webaccess” is not showing up.

Personally, I wouldn’t touch Index of /Cisco/IOS/IP Phones/7942G/English . The server appears to be hosted in Tehran, Iran.

From briefly browsing Cisco 9971 phone configuration working example with setup tips - #47 by troy_orndoff I got the impression that they’re focusing on “No trust List” being available. That requirement should be removed once you’re resetting to firmware default.

7

Thanks for all your help @JamesKirk1989 I finally got it. The main problem was that there was something wrong or incomplete with my SEP(MAC) config file, and if the phone rejects that file it won’t say why and none of your settings will be applied even if they individually are correct.

Here is my now working config file for the 9951 incase anyone in the future wants to try to set one up without spending 4 days debugging it. This is probably a lot more than you need but it’s the only version of this file that actually registered the phone for me. I based it off of this article I found that was very helpful and seemed to have one of the only complete examples of the config file I could find: Cisco 9971 IP Phone with FreePBX / Asterisk

<?xml version="1.0" encoding="UTF-8"?>
<device>
    <advertiseG722Codec>1</advertiseG722Codec>
    <deviceProtocol>SIP</deviceProtocol>
    <webAccess>0</webAccess>
    <devicePool>
        <dateTimeSetting>
            <dateTemplate>M/D/YA</dateTemplate>
            <timeZone>Pacific Standard/Daylight Time</timeZone>
            <ntps>
                <ntp>
                    <name>pool.ntp.org</name>
                    <ntpMode>Unicast</ntpMode>
                </ntp>
            </ntps>
        </dateTimeSetting>
        <callManagerGroup>
            <members>
                <member priority="0">
                    <callManager>
                        <ports>
                            <ethernetPhonePort>2000</ethernetPhonePort>
                            <sipPort>5060</sipPort>
                            <securedSipPort>5061</securedSipPort>
                        </ports>
                        <processNodeName>192.168.20.46</processNodeName>
                    </callManager>
                </member>
            </members>
        </callManagerGroup>
    </devicePool>
    <sipProfile>
        <sipProxies>
            <backupProxy />
            <backupProxyPort>5060</backupProxyPort>
            <emergencyProxy />
            <emergencyProxyPort />
            <outboundProxy />
            <outboundProxyPort />
            <registerWithProxy>true</registerWithProxy>
        </sipProxies>
        <sipCallFeatures>
            <cnfJoinEnabled>true</cnfJoinEnabled>
            <callForwardURI>x-serviceuri-cfwdall</callForwardURI>
            <callPickupURI>x-cisco-serviceuri-pickup</callPickupURI>
            <callPickupListURI>x-cisco-serviceuri-opickup</callPickupListURI>
            <callPickupGroupURI>x-cisco-serviceuri-gpickup</callPickupGroupURI>
            <meetMeServiceURI>x-cisco-serviceuri-meetme</meetMeServiceURI>
            <abbreviatedDialURI>x-cisco-serviceuri-abbrdial</abbreviatedDialURI>
            <rfc2543Hold>false</rfc2543Hold>
            <callHoldRingback>2</callHoldRingback>
            <URIDialingDisplayPreference>1</URIDialingDisplayPreference>
            <localCfwdEnable>true</localCfwdEnable>
            <semiAttendedTransfer>true</semiAttendedTransfer>
            <anonymousCallBlock>0</anonymousCallBlock>
            <callerIdBlocking>2</callerIdBlocking>
            <dndControl>0</dndControl>
            <remoteCcEnable>true</remoteCcEnable>
            <retainForwardInformation>false</retainForwardInformation>
        </sipCallFeatures>
        <sipStack>
            <sipInviteRetx>6</sipInviteRetx>
            <sipRetx>10</sipRetx>
            <timerInviteExpires>180</timerInviteExpires>
            <timerRegisterExpires>3600</timerRegisterExpires>
            <timerRegisterDelta>5</timerRegisterDelta>
            <timerKeepAliveExpires>120</timerKeepAliveExpires>
            <timerSubscribeExpires>120</timerSubscribeExpires>
            <timerSubscribeDelta>5</timerSubscribeDelta>
            <timerT1>500</timerT1>
            <timerT2>4000</timerT2>
            <maxRedirects>70</maxRedirects>
            <remotePartyID>false</remotePartyID>
            <userInfo>None</userInfo>
        </sipStack>
        <autoAnswerTimer>1</autoAnswerTimer>
        <autoAnswerAltBehavior>false</autoAnswerAltBehavior>
        <autoAnswerOverride>true</autoAnswerOverride>
        <transferOnhookEnabled>false</transferOnhookEnabled>
        <enableVad>false</enableVad>
        <dtmfAvtPayload>101</dtmfAvtPayload>
        <dtmfDbLevel>3</dtmfDbLevel>
        <dtmfOutofBand>avt</dtmfOutofBand>
        <alwaysUsePrimeLine>false</alwaysUsePrimeLine>
        <alwaysUsePrimeLineVoiceMail>false</alwaysUsePrimeLineVoiceMail>
        <kpml>3</kpml>
        <phoneLabel>Your name</phoneLabel>
        <stutterMsgWaiting>2</stutterMsgWaiting>
        <callStats>false</callStats>
        <silentPeriodBetweenCallWaitingBursts>10</silentPeriodBetweenCallWaitingBursts>
        <disableLocalSpeedDialConfig>false</disableLocalSpeedDialConfig>
        <sipLines>
            <line button="1">
                <featureID>9</featureID>
                <featureLabel>Room - 1</featureLabel>
                <proxy>USECALLMANAGER</proxy>
                <port>5060</port>
                <name>1</name>
                <displayName>Room - 1</displayName>
                <autoAnswer>
                    <autoAnswerEnabled>0</autoAnswerEnabled>
                </autoAnswer>
                <callWaiting>3</callWaiting>
                <authName>1</authName>
                <authPassword>password</authPassword>
                <sharedLine>false</sharedLine>
                <messageWaitingLampPolicy>1</messageWaitingLampPolicy>
                <messagesNumber>*97</messagesNumber>
                <ringSettingIdle>4</ringSettingIdle>
                <ringSettingActive>5</ringSettingActive>
                <contact>1</contact>
                <busyTrigger>2</busyTrigger>
                <forwardCallInfoDisplay>
                    <callerName>true</callerName>
                    <callerNumber>false</callerNumber>
                    <redirectedNumber>false</redirectedNumber>
                    <dialedNumber>true</dialedNumber>
                </forwardCallInfoDisplay>
            </line>
        </sipLines>
        <voipControlPort>5060</voipControlPort>
        <startMediaPort>16348</startMediaPort>
        <stopMediaPort>20134</stopMediaPort>
        <dscpForAudio>184</dscpForAudio>
        <ringSettingBusyStationPolicy>0</ringSettingBusyStationPolicy>
        <dialTemplate>dialplan.xml</dialTemplate>
        <softKeyFile />
    </sipProfile>
    <commonProfile>
        <phonePassword />
        <backgroundImageAccess>true</backgroundImageAccess>
        <callLogBlfEnabled>2</callLogBlfEnabled>
    </commonProfile>
    <loadInformation>sip9951.9-3-2-10</loadInformation>
    <inactiveLoadInformation>sip9951.9-3-2-10</inactiveLoadInformation>
    <vendorConfig>
        <g722CodecSupport>1</g722CodecSupport>
        <handsetWidebandEnable>1</handsetWidebandEnable>
        <headsetWidebandUIControl>1</headsetWidebandUIControl>
        <disableSpeaker>false</disableSpeaker>
        <disableSpeakerAndHeadset>false</disableSpeakerAndHeadset>
        <pcPort>0</pcPort>
        <settingsAccess>1</settingsAccess>
        <garp>1</garp>
        <voiceVlanAccess>1</voiceVlanAccess>
        <videoCapability>1</videoCapability>
        <autoSelectLineEnable>0</autoSelectLineEnable>
        <webAccess>0</webAccess>
        <daysDisplayNotActive></daysDisplayNotActive>
        <displayOnTime>08:00</displayOnTime>
        <displayOnDuration>16:00</displayOnDuration>
        <displayIdleTimeout>00:02</displayIdleTimeout>
        <spanToPCPort>0</spanToPCPort>
        <loggingDisplay>1</loggingDisplay>
        <ciscoCamera>1</ciscoCamera>
        <loadServer />
    </vendorConfig>
    <userLocale>
        <name>English_United_Kingdom</name>
        <uid />
        <langCode>en</langCode>
        <version>1.0.0.0-1</version>
        <winCharSet>iso-8859-1</winCharSet>
    </userLocale>
    <networkLocale>United_Kingdom</networkLocale>
    <networkLocaleInfo>
        <name />
        <uid />
        <version>1.0.0.0-1</version>
    </networkLocaleInfo>
    <deviceSecurityMode>1</deviceSecurityMode>
    <authenticationURL />
    <directoryURL />
    <servicesURL />
    <idleURL />
    <informationURL />
    <messagesURL />
    <proxyServerURL />
    <dscpForSCCPPhoneConfig>96</dscpForSCCPPhoneConfig>
    <dscpForSCCPPhoneServices>0</dscpForSCCPPhoneServices>
    <dscpForCm2Dvce>96</dscpForCm2Dvce>
    <transportLayerProtocol>1</transportLayerProtocol>
    <capfAuthMode>0</capfAuthMode>
    <capfList>
        <capf>
            <phonePort>3804</phonePort>
        </capf>
    </capfList>
    <certHash />
    <encrConfig>false</encrConfig>
</device>

Important other things that were not intuitive when setting up the phone for the first time:

  • The phone requests a lot of different files on boot in order to register, here is the list of everything I have in my TFTP directory
    • ITLFile.tlv - blank
    • ITLSEP9C57AD02853E.tlv - blank
    • English_United_Kingdom - directory containing lk-sip.jar
    • g4-tones.xml - xml file with ringtone data
    • CTLSEP9C57AD02853E.tlv - blank
    • SEP(MAC).cnf.xml - config file listed above
  • It was really hard for me to find any of these on cisco’s website or just the internet in general, I ended up downloading g4-tones.xml and lk-sip.jar from a server in Iran as @JamesKirk1989 pointed out :confused: but after decompiling the lk-sip.jar I saw that it was a group of 4 xml files that have locale information in them about what to call the menu items once the phone starts up depending on the language that is set, so it seems safe enough. I can upload these xml files somewhere if other people need them.
  • When you set up an extension in PBX, the default password is too long or incompatible in some way. I kept getting authentication errors when trying to register the first time and the only way I was able to fix it was changing the default password that is used to something shorter.
  • Enabling the web server is 0 instead of 1 like most other settings, this is a really helpful website to figure that out: SEPMAC.cnf.xml
  • Make sure to enable listening on TCP in PBX or the phone won’t be able to register. UDP was only enabled for me in Settings → Asterisk SIP settings → SIP settings [chan_pjsip] tab by default.

What a marathon.

8

Nice! Congrats on the 4 days, it was 182 for me :slight_smile:
Check out sccp_manager/Technical.notes/backgroundImage.txt at develop · chan-sccp/sccp_manager · GitHub for the wallpaper sizes and where to place them in the tftp directory should you want to further individualize.

For Ringtones check:
Custom Ringtone CME w/ CLI

If you find a way to play different ringtones depending on the caller ID, lemme know.