Showing results for 
Search instead for 
Did you mean: 
Patrick Born
Cisco Employee
Cisco Employee

-- 11/23/2010 corrected page numbering

This application note describes how to automate the installation and configuration of the Cisco SPA5xx IP phone family. Implementers of this document are expected to be familiar with IP networking and the administration tasks involved with configuring VoIP in an Asterisk environment.

This document provides step-by-step examples that will help any reader better understand the SPA IP Phone or SPA ATA provisioning process.


Need this about 3 weeks ago.  Of course I did everything you did here and it works.  But it would have been nice to to have to rediscover the wheel.

Steven Howes

Few typo's in this document. 'DCHP' is mentioned a few times instead of 'DHCP'... The actual content is useful though.

Patrick Born
Cisco Employee
Cisco Employee

<blush> Thanks for letting me know Steve. I've replaced both DCHP with DHCP.






I have tried following this configuration guide and failed miserably! I am able to get 7960, 7961, and 7970 IP phones to configure and register with Asterisk, however I cannot seem to get my SPA509G to even configure (let alone register).

I have created "spa509G.cfg" and "spa1cdf0f4ac22.cnf" (notice I changed the letters in this one to all lower case as documented)

It Seems that when the phone boots, it is requesting the following files from my TFTP Server. SEP1CDF0F4A4C22.cnf.xml, which of course fails because the file does not exist. The phone then requests XMLDefault509G.cnf.xml and again fails.  Lastly it requests XMLDefault.cnf.xml

I am using a SPA509G currently with SIP Firmware version 7.4.7 I had previously tried with firmware version 7.4.3 (I think).

According to the guide,
" The phone reads its factory default profile rule which causes the phone to request of the specified server, a configuration file based on its model number, example spa504G.cfg"

So in my case, I would expect it to request spa509G.cfg ...Does anyone have any ideas why it would ask for the SEP....cnf.xml file first?

I have tried reseting the Phone to factory defaults.

Any insight would be great!




I'm curious to understand why the document states to set the <Resync_Period> parameter to ten seconds.  I've found that the phone will continue to resync and reboot at the duration defined by this parameter and further find the Cisco default value of 3600 seconds to be too often.  Is there a way to configure the phone to resync at a given period but reboot only if a change is detected in the configuration file?



Patrick Born
Cisco Employee
Cisco Employee

Hi Brian,

Please try to carefully follow each step of the document again, the steps really do work. Notice that the document does not provide steps for creating a SEP*.cnf.xml file like you said you provided.

You ask, "So in my case, I would expect it to request spa509G.cfg ...Does anyone have any ideas why it would ask for the SEP....cnf.xml file first?"

The phone is attempting to switch to SPCP-mode. If it does not find SPCP-related config files, it will go on to request the /spa$PSN.cfg file. Notice the / (slash), that means the root directory of your provisioning server.

In order to better understand the problem, take a look at *exactly* what the DHCP server is sending the phone in OPTION 66. The phone behaves differently, depending on what information is provided in the DHCP OFFER.

Here are more details about how the phones boot up:

The SPA5xx IP phones can operate in either SIP-mode or SPCP-mode [UC500-mode].

When the phones boot they do the following:

1. Acquires power from PoE or optional power supply
2. Performs a power on self test (POST)
3. Runs Cisco Discovery Protocol (CDP)
4. If a CDP response is received, the phone moves to advertised voice VLAN
5. Transmits DHCP discover on default VLAN if no voice VLAN discovered with CDP
6. Receives DHCP OFFER
7. Requests the following IP settings from the DHCP server:
• DHCP option #1 IP subnet Mask
• DHCP option #3 Router / Default IP gateway
• DHCP option #6 DNS server IP address
• DHCP option #50 IP address
• DHCP option #66 TFTP server name or IP address [RFC2132]
8. The phone checks the Upgrade_Rule and if the rule evaluates to true, performs the specified firmware upgrade and reboots.
9. The phone checks its Resync_Periodic timer. If expired, the phone checks for configuration updates by requesting configuration files from the provisioning server/s described in the phone's:
a. Profile_Rule
b. Profile_Rule_B
c. Profile_Rule_C
d. Profile_Rule_D
10. The phone registers to the specified SIP server/s and is ready to make calls.

The Cisco SPA5xx phone boot behavior is dependent on the received DHCP OPTION 66 contents.

The phone first attempts to switch from SIP to SPCP mode by looking for the following 3 files:
• tftp:// [where 00270D581F28 is the booting phone's MAC address]
• tftp:// [where the phone is a SPA525G2] [could be 525G for SPA525G, or 504G if phone is SPA504G]
• tftp://
The phone now knows that it is meant to run in SIP-mode and attempts to locate its SIP-mode configuration file, looking in any location that it knows about:
• tftp:// [because of $PSN in the phone's default Profile rule] [where the phone is a SPA525G2] [could be 525G for SPA525G, or 504G if phone is SPA504G]
• tftp:// [where 00270D581F28 is the booting phone's MAC address] [where the phone is a SPA525G2] [could be 525G for SPA525G, or 504G if phone is SPA504G]

Long story short, carefully follow the steps in the document and you will be successful. If not, let me know and I'll correct the document appropriately.




Patrick Born
Cisco Employee
Cisco Employee

Hi Rick,

I suggest setting the Resync_Periodic to 10 in the spa$PSN.cfg file because this is the file that a factory-fresh phone will look for. I hate waiting around waiting, so 10 seconds is a good time for the phone to wait before performing a request for its unique configuration file based on its MAC address.

The phone's unique configuration file should set this timer to whatever works best for the deployment scenario. I've seen some set it to an hour, some to 24 hours, and some to several days. Basically, figure out how long you're prepared to wait before any changes you make to a phone's configuration will be propagated to the phone.

The phones will resync based on the Resync_Periodic timer and will change their configuration accordingly. If a parameter requiring a reboot is changed, then the phone will reboot. This document describes which parameters cause a reboot when changed:




You only need one reference document for all SPA phone firmware, information, and utilities.


Thanks for the response Patrick.  I did finally did enough reading to understand why the phone was looking for "SEP....cnf.xml".  My problem turned out to be that the "SPA{mac address}.xml files I created with the provided utility and then edited were "corrupt". Could have been from copying them to and from several locations or just editing them with notepad.exe. Even though my TFTP servers never reported the corruption to me -- I stumbled upon it in the "Status" page accessed from the phone itself.


Joerg -

I experienced the same behaviour. with software 7.4.8...

Even a backup from a running config failed during resync with a "corrupt" status from the phone.

Any workaround yet??



Hi Patrick,

I have found  your post and see that you are well experienced with spa phones and asterisk. I have serious problem with choppy sound on spa 525G2. I have about 80 phones mix of spa525g2 and spa504. Audio is crackly on every call or gets crackly after few seconds of conversation.

Setup as follows

Phones tested against:

asterisk 1.4.30 on Vmware ESXi 4.1 IBM Server,  router cisco 877

Phones 7911,7912,7921,7965(SCCP) connected to the same  asterisk pbx using chan_sccp-b - no issue

Yealink phone SIP - no issue

Cyberdata sip intercom - no issue

XLite softphone  sip - no issue

Polycom IP550 - no issue

Flat network setup, no qos, no vlans Linksys managed  switch

asterisk on Vmware ESXi 3.5 HP DL360  G3, router cisco 1921 VOICE and DATA VLAN configured, QOS on VOICE VLAN  CISCO SG300 GBit POE switch

vad - disbaled

silencetreshold = 1024

Vmware tools and vm kernel installed on both instances of centos hosting asterisk.

RTP and SIP ports opened on firewall.

RTP packet size set to 20ms on the phone

jitter set to low

tested against codec g711 and g729 - g729 prefered

Firmware 7.4.5, 7.4.7, 7.4.8

In both scenarios calls are made via sip trunk

no PSTN lines connected. This is purely IP based setup

SPA525G2, SPA508 SPA504 SIP - audio issue as described on both systems with internal and external calls.

I have  slighlty removed a bass effect by disabling deep  bass option. This made serious change but we still struggle with very  bad cracks after short time and "push to talk/VAD" effect.

Please advice as we are running out of time.



cindy toy
Rising star
Rising star

Hi Konrad,

Thank you for your question however it would be best served in a discussion area instead of a comment area. Please post your question here:  This area will give your question more visibility for people to help.


Cindy Toy

Cisco Small Business Community Manager

for Cisco Small Business Products

Dan Lukes
VIP Alumni
VIP Alumni
[page 13] you cannot factory reset password protected phone, if you do not have it's admin password

It seems no not be true. As far as I know, the factory-reset can't be initiated via SIP notify nor directly via an URL written within browser. So we are speaking about factory-reset triggered via phone's menu.

Configuration of device (SPA508G fw. 7.5.4):

Enable Web Server:    Web Server Port:    80
Enable Web Admin Access:    Admin Passwd:    **********
User Password:    Signaling Protocol:   
SPCP Auto-detect:    Phone-UI-readonly:   

According configuration I assume, the device has administrator password set. In advance, device asks for it during browser access, so it seems the device really has administrator password set.

Despite of it, I can select menu item "reset to factory default" and device will do it with no complains ...



In my situation the dhcp at the remote site is not configured for option 66 and we hav eno access to it.

Can I somehow hard code the tftp server in the spa525G2 as opposed to let dhcp giv eit the IP?

Thank you

Dan Lukes
VIP Alumni
VIP Alumni

Of course - you can configure Profile_Rule manually within it. Or you may trigger loading of particular profile using standard browser using URL like


(you may refer to configuration located not only on tftp server but on ftp, http or https server as well)

Those methods require manual intervention from you, of course, but it's price for not to having DHCP server under your control on your network.

Well, there is another, non-DHCP method of "zero touch" configuration. Ask Cisco for customized unit. Sorry, I know no details beyond that it's possible (see Info tab, option Custimization - customized units doesn't have "Open" value claimed here).

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: