As if it wasn't challenging enough to get new firmware for these phones, sometimes bad things happen as part of the update process.

In particular, we ran into a problem going from SIP 6.3 to SIP 7.2. Having successfully loaded the Universal Application Loader, our phone promptly went into a loop, requesting "CTLSEP<mac>.tlv" from the server. Some inspection of the Cisco documentation suggested that this file should not be needed, but in typical fashion, also stated that an empty file would be needed to disable the security functions. Creating this file moved things along (see note below), and the phone then began looping to transfer "SEP<mac>.cnf.xml". The Cisco documentation again suggested that this was only a step along a decision tree, and implied that the phone would just begin trying other things, but this didn't seem to be happening. An empty "SEP<mac>.cnf.xml" did not help matters, and we wound up with the dreaded "Protocol Application Invalid" error, making our previously functional phone into an expensive paperweight.

Lots of Cisco and Google searching failed to yield the correct fix, until some helpful individual came along and provided a little bit of XML magic for the SEP<mac>.cnf.xml file:

<Default>
   <callManagerGroup>
       <members>
           <member  priority="0">
               <callManager>
                   <ports>
                       <ethernetPhonePort>2000</ethernetPhonePort>
                   </ports>
                   <processNodeName>192.168.0.1</processNodeName>
               </callManager>
           </member>
       </members>
   </callManagerGroup>

   <loadInformation6  model="IP Phone 7910"></loadInformation6>
   <loadInformation124  model="Addon 7914"></loadInformation124>
   <loadInformation9  model="IP Phone 7935"></loadInformation9>
   <loadInformation8  model="IP Phone 7940"></loadInformation8>
   <loadInformation7  model="IP Phone 7960">P0S3-07-2-00</loadInformation7>
   <loadInformation20000  model="IP Phone 7905"></loadInformation20000>
   <loadInformation30008  model="IP Phone 7902"></loadInformation30008>
   <loadInformation30007  model="IP Phone 7912"></loadInformation30007>
</Default>

It appears that, after it loads the firmware the first time, a null file will suffice for the .xml file.

Notes added Feb 2005:

News! I was helping someone upgrade their phone and we saw a variation on the "stuck on CTLSEP<mac>.tlv" issue. In this new case, creating an empty CTLSEP<mac>.tlv file wasn't sufficient - the phone would hang while successfully retrieving this empty file every few seconds. It appears that removing this file AFTER the phone has been asking for it for a little while may be a useful strategy, as this was apparently what got things moving along again. Thanks to Jason for this clever little bit of workaround. A bronx cheer to Cisco for the stupidest coding and misdocumentation of how this is all supposed to work.

Another minor note. It appears that the phone will retain settings for TFTP server, etc., and once you've got it flashed with the Application Loader, you've essentially bricked it as far as being able to change any settings goes. tcpdump is your friend to see what the dumb thing is doing. In the event you were trying to use a non-local TFTP server and got locked into some bad settings, always remember that you can temporarily reconfigure your local network to addresses that the phone is trying to use.

Notes added Nov 2005, revised May 2006:

You can perform a factory reset of the Cisco 7940, 7941, 7960, 7961 and 7970 phone by holding down "#" as it powers up (or resets), at which point you then dial 123456789*0#. This is useful for many types of recovery, especially when the phone is so disabled that it cannot enter Network Configuration to reset to factory default.