Modify the Wifi Configuration of 500 phones

[Florent CHETAIL]

Hi,

I'm looking for a tool which can modify wifi encryption of my 500 x 7921G phones.

I found the Bulk Deployment Utility but "All Users" have to reset their phones to factory default.

Is there a way to do it myself ?

Thx

[scottg.irey · Accepted solution]

Just going through this ourselves.

You can use the bulk deployment utility to create and save your profile config to the default config file. This will generate a wlanconfig.xml file which you put on your tftp server. The phone will look for this file on boot or new connection and apply the new config as profile number 1. No need to factory default first. We are still testing and have not deployed yet but have not run into any issues.

Sent from Cisco Technical Support iPhone App

[migilles · Accepted solution]

You don't have to factory reset the 792x phones, just need to have WLAN connectivity to a TFTP server with the template created from the Cisco Bulk Deployment Utility (BDU).

You can modify any or all of the 4 profiles.

There are 2 methods for exporting templates.

1) A default (global) template (WLANDefault.xml) to use for all 792x phones (e.g. WPA2-PSK).

2) A template per phone/MAC (WLAN.xml) where 792x phones have different configs (e.g. Unique 802.1 credentials).

Factory reset method may be referring to the pre-deployment scenario.

But definitely customers use the BDU after 792x phones have been deployed; to rotate credentials, keys, etc.

Refer to the BDU readme or the 7925G Deployment Guide for more info on the BDU.

http://www.cisco.com/web/software/282074239/14006/792xBD.1-0-Readme.pdf

Sent from Cisco Technical Support iPhone App

[Florent CHETAIL]

Thanks, but i found another solution for my issue.

Maybe i'll test this another time.

[George Stefanick]

I wanted to throw in the mix. I use Wavelink Avalanche for managing our phones. The phones have a native agent on the phone from Cisco. Works very well ..

__________________________________________________________________________________________
"Satisfaction does not come from knowing the solution, it comes from knowing why." - Rosalind Franklin

[migilles]

Using Wavelink to manage the 792x phones is a good solution, but can be a bit tedious if your phones have unique credentials as you would need to create a template per phone manually.

But if you use PSK or a common 802.1x account for all phones, then just need to create one template for all phones.

Would suggest to use the Cisco BDU if using unique 802.1x credentials.

[George Stefanick]

Specific to the Cisco BDU. Can you rotate PSK keys on exitsing phones already deployed? I understood BDU was used for new phones to get the profiled onto the phone to connect to the network. And that as pretty much it. Is that the case ?

__________________________________________________________________________________________
"Satisfaction does not come from knowing the solution, it comes from knowing why." - Rosalind Franklin

[migilles]

Nope.  Can be utilized in any scenario where the 792x has WLAN connectivity to a TFTP server; either initial deployment or post-deployment.

But for post-deployment, would need to put the templates exported onto the CUCM's TFTP server and restart the TFTP service for those files to be active in TFTP service.

[George Stefanick]

Interesting ... The templates, you mean the phone templates. So if you use 802.1X with accounts how does the template not overwright this info ?

__________________________________________________________________________________________
"Satisfaction does not come from knowing the solution, it comes from knowing why." - Rosalind Franklin

[migilles]

Yes, templates means config files that are exported when you choose the default or bulk export method.

Bulk references a CSV file with MAC address, username and password.

If you leave the username and password blank, then the 792x phone will retain its current username and password.

A scenario may be the following:

You have currently deployed the 792x phones in your enterprise utilizing LEAP, but now want to change to PEAP-MSCHAPv2.  In this scenario the users manage their user account, so you don't know their credentials.

Simply create a config file leaving username and password blank, export the config file / template, put it on the CUCM TFTP server, restart the TFTP service, then restart the 792x phones.

You will then see the security type has changed while still retaining the previous user credentials.

The above is assuming the username and password are stored to flash and the prompt mode feature is not used, but if that were the case, then wouldn't matter for profile 1.

Give it a go!