WarmTransfer
cisco onprem uc · published

Cisco IP phone registration and TFTP and ITL and CTL

Verified 2026-09-24 · 60 sources · tier 2 · 1 superseded

Superseded guidance: 1 source has been superseded by newer ones.

Cisco IP phones follow a multi-stage startup sequence to locate TFTP services, validate security trust lists, download configuration files, and establish signaling sessions with Cisco Unified Communications Manager (Unified CM) 7​11​8. Successful registration requires the device to be present in the Unified CM database or for autoregistration to be enabled on the cluster 47.

Phone Startup and TFTP Discovery

During initialization, a Cisco IP Phone 8800 connected to a Cisco Catalyst switch receives its defined voice VLAN from the switch prior to requesting an IP address 59. For IPv4 endpoints, Cisco recommends DHCP option 150 to provide devices with the Unified CM TFTP server address, while DHCP option 066 and the CiscoCM1 name serve as documented alternatives 41. If DHCP does not supply a TFTP server address, the TFTP server must be configured locally on the phone, which then contacts it directly 28. When troubleshooting an 8800 phone, guidance instructs administrators to check the Option 150 address when using DHCP, set TFTP Server 1 manually with a static IP, and enable Alternate TFTP when a phone has moved locations 1.

Firmware and configuration files are downloaded from Unified CM TFTP using UDP port 69, with the file transfer continuing over an ephemeral port 45. In addition, TCP port 6970 on the TFTP node serves HTTP-based downloads of firmware and configuration files, while TCP ports 6971 and 6972 provide an HTTPS interface used for secure configuration downloads 43.

Configuration Files and Registration Signaling

SCCP phones, SIP phones, and gateways request a configuration file from TFTP when they initialize, and TFTP delivers an updated file whenever device settings change 7. This configuration file carries a prioritized list of Unified CM nodes, the TCP ports used to reach them, locale details, and service URLs 6. When autoregistration is active and a phone is not present in the Unified CM database, the phone fetches the default configuration file XmlDefault.cnf.xml from TFTP 60. Devices lacking Security By Default (SBD) support are served a nonsigned default configuration file under autoregistration 58.

After retrieving its configuration file, the phone attempts connection to the highest-priority Unified CM node in its list, utilizing TLS when operating in secure mode and TCP when operating nonsecurely 11. Registration signaling uses the following network ports 44:

Protocol Nonsecure Port Secure Port
SCCP TCP 2000 TCP 2443 44
SIP TCP/UDP 5060 TCP 5061 44

Cisco's registration troubleshooting technote states that phones will not register if they are assigned a secure device security profile without having a Locally Significant Certificate (LSC) installed 52. The Cisco Certificate Authority Proxy Function (CAPF) listens on TCP port 3804 to issue LSCs to IP phones 42.

Initial Trust List (ITL) and Security By Default

Security By Default provides supported Cisco IP phones with a baseline level of security without requiring extra configuration, supplying default TFTP file authentication, optional configuration encryption, and certificate verification 51. An ITL file is generated automatically when TFTP is activated during cluster installation and rebuilds automatically whenever its contents change, requiring no manual security feature activation 12. Cisco IP phones download the ITL file during a restart, a reset, or immediately after downloading a Certificate Trust List (CTL) file 15.

A phone lacking a CTL file automatically trusts the initial ITL file it receives; if a CTL file exists, the phone uses the CTL to authenticate the ITL signature 16. In Release 15, the ITL file is signed by the ITLRecovery certificate 22. The contents of the ITL serve specific verification functions 13​24:

  • CallManager certificate: Enables the phone to authenticate the signature of the ITL file itself as well as the signature on its configuration file 13.
  • Trust Verification Service (TVS) certificates: Allow the phone to communicate securely with TVS on TCP port 2445 24​46.
  • CAPF certificate: Supports configuration file encryption; this certificate is not strictly required in the ITL because TVS can authenticate it 24.

TVS runs on Unified CM nodes and validates certificates on behalf of phones so devices do not need to store every trusted certificate directly 57. If a phone is unable to verify a certificate or signature using its local CTL or ITL, it contacts a TVS server to perform verification 56.

Within Unified CM Administration, administrators can monitor phone trust states under Device > Phone using the ITL File Status filter, which displays values of Match, MisMatch, Not Installed, and Unknown 23.

ITL Maintenance, Recovery, and Cluster Migration

Cisco warns never to regenerate CallManager.pem and TVS.pem certificates simultaneously; once either certificate is regenerated, TFTP and TVS services must be restarted and phones reset to obtain the updated ITL 39. Cisco's SBD technote notes that there is no Cisco-provided mechanism to remotely delete ITL files across all phones simultaneously; removing the file requires manual intervention per phone, or performing a factory reset if phone settings access is restricted 40. Centralized TFTP deployments function only in an ITL-homogeneous environment where all nodes run Unified CM 8.x or later, or all run pre-8.x releases 4.

The ITLRecovery key was introduced in Unified CM 10.0(1) to aid recovery when trust is lost; it is created during installation or upgrade and remains unchanged across hostname or DNS modifications 27. In Release 15, the ITLRecovery certificate carries a default validity of 20 years (configurable to 5, 10, 15, or 20 years) and persists across upgrades 25.

When phones no longer trust the ITL signer, an administrator executes a bulk reset using the CLI command utils itl reset to restore trust between phones and the TFTP service 19. The command strips the existing signature from the publisher's ITL, re-signs the file using the ITLRecovery private key, and distributes the file to the TFTP directories of all active TFTP nodes 18. Administrators have two key source options:

  • utils itl reset localkey: Employs the ITLRecovery private key stored locally on the publisher within ITLRecovery.p12 17.
  • utils itl reset remotekey: Downloads an ITLRecovery.p12 file from an external SFTP server to substitute for the local file 20.

Following the CLI reset command, devices must be reset via System > Enterprise Parameters > Reset to prompt phones to download the newly signed ITL 21.

When migrating phones across clusters, the Release 15 Security Guide identifies configuring the enterprise parameter Prepare Cluster for Rollback to pre-8.0 to True as the most preferred method 50. Setting this parameter directs phones to download an ITL containing empty TVS and TFTP certificate sections, enabling them to accept unsigned configuration files and install any subsequent ITL 49.

Cluster Security Modes and the CTL File

A fresh Unified CM installation functions in non-secure mode by default 10. Mixed mode (also known as secure mode) allows concurrent support for secure and non-secure devices within the same cluster 30. Enabling mixed mode requires that Unified CM is registered with Cisco Smart Software Manager or a satellite using a token with Allow Export-Controlled functionality enabled, and requires activation of both Cisco CAPF and Cisco CTL services on the publisher 31​32.

Administrators enable mixed mode from the publisher CLI via utils ctl set-cluster mixed-mode (which updates the CTL file) and revert using utils ctl set-cluster non-secure-mode 29. Active mixed mode is confirmed when Cluster Security Mode shows a value of 1 under System > Enterprise Parameters 5. In mixed mode, any newly uploaded certificate requires updating the CTL across all cluster nodes using the CLI command utils ctl update CTLFile 9.

During startup, an 8800 phone requests the CTL file before requesting the ITL file from TFTP 8.

8800 Series Status Messages and Troubleshooting

The Cisco IP Phone 8800 series displays its 30 most recent status messages under Applications > Admin settings > Status > Status messages 55. Documented startup and security messages include 37​34​33​36​35​38:

Status Message Meaning / Documented Indication
TFTP timeout TFTP server did not respond, indicating a network or TFTP server issue 37.
File Not Found <CTLFile.tlv> Cluster is not in mixed mode; no CTL file is present to download 34.
File not found The phone's configuration file is missing from the TFTP server 33.
No Trust List installed Neither an ITL nor a CTL file is installed on the phone 36.
Phone failed to register. Cert key size is not FIPS compliant An RSA certificate shorter than 2048 bits was detected and must be replaced 35.
Trust List update failed CTL and ITL update failed, indicating a server-side or network fault 38.

Applicability

Applies to: Cisco Unified Communications Manager and Cisco IP Phone 8800 Series. Deployments: on-premises. Sources checked 2026-09-24. The ITLRecovery key was introduced in Unified CM 10.0(1) 27. Centralized TFTP requires all servers on Unified CM 8.x or later, or all on releases before 8.x 4. In Release 15 the ITL file is signed by the ITLRecovery certificate, and the certificate validity is 20 years by default 22​25.

What remains uncertain

  • Per-model ITL delete menu paths for phones are not covered by the sources below.
  • Status messages and registration errors for desk phones are not covered by the sources below.
  • ITL and TFTP behaviour for phones registering over MRA via Expressway is not covered by the sources below.
  • Phone precedence when both DHCP option 150 and option 66 are offered is not covered by the sources below.
  • Specific workflow steps for CAPF LSC enrollment and secure device security profiles are not covered by the sources below.
  • The content of the technote on troubleshooting IP phone unregistration issues in CUCM is not covered by the sources below.
  • The replacement for the technote on SIP phone registration processes is not covered by the sources below.
  • Resolving conflicts regarding autoregistration in mixed mode is not covered by the sources below.

See also

Referenced by

Sources

  1. 1
    The 8800 troubleshooting guidance says to check the Option 150 address when using DHCP, set TFTP Server 1 manually with a static IP, and enable Alternate TFTP when a phone has moved locations.
    Cisco IP Phone 8800 Series Administration Guide for Cisco Unified Communications Manager - Troubleshooting · Troubleshooting, Startup Problems, TFTP Server Settings · Checked 2026-09-24
  2. 2
    The 8800 administration guide states that autoregistration is disabled when the CTL client is configured, so phones must then be added to the database manually.disputed
    Cisco IP Phone 8800 Series Administration Guide for Cisco Unified Communications Manager - Technical Details · Phone Startup Process, note under Request Configuration File · Checked 2026-09-24
  3. 3
    The Release 15 Security Guide states that autoregistration is supported in both mixed mode and nonsecure mode and that the default configuration file is signed.disputed
    Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Default Security · Default Security chapter, Autoregistration section · Checked 2026-09-24
  4. 4
    Centralized TFTP only works in an ITL-homogeneous environment: all servers on Unified CM 8.x or later, or all on releases before 8.x.
    Understand CUCM Security By Default and ITL Operation and Troubleshooting · Centralized TFTP section · Checked 2026-09-24
  5. 5
    Mixed mode is confirmed under System > Enterprise Parameters, where the Cluster Security Mode value is 1.
    Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Security Modes · Security Modes chapter, verify security mode · Checked 2026-09-24
  6. 6
    The device configuration file served by Unified CM TFTP carries a prioritized list of Unified CM nodes and the TCP ports used to connect to them, plus locale information and service URLs.
    System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure TFTP Servers · Configure TFTP Servers chapter, TFTP overview · Checked 2026-09-24
  7. 7
    SCCP phones, SIP phones and gateways request a configuration file from TFTP when they initialize, and an updated configuration file is sent when the device configuration changes.
    System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure TFTP Servers · Configure TFTP Servers chapter, TFTP overview, first paragraph · Checked 2026-09-24
  8. 8
    In the 8800 startup process the phone requests the CTL file first and then the ITL file, both from the TFTP server.
    Cisco IP Phone 8800 Series Administration Guide for Cisco Unified Communications Manager - Technical Details · Phone Startup Process, steps Request CTL File and Request ITL File · Checked 2026-09-24
  9. 9
    In mixed mode the CTL file must be updated whenever a new certificate is uploaded, using utils ctl update CTLFile, which distributes the updated CTL to all cluster nodes.
    Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Security Modes · Security Modes chapter, update CTL file · Checked 2026-09-24
  10. 10
    A fresh Unified CM installation runs in non-secure mode by default.
    Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Security Modes · Security Modes chapter, overview · Checked 2026-09-24
  11. 11
    After obtaining its configuration file, the phone attempts to connect to the highest-priority Unified CM node on the list, using TLS when secure and TCP when nonsecure.
    Cisco IP Phone 8800 Series Administration Guide for Cisco Unified Communications Manager - Technical Details · Phone Startup Process, step Contact Cisco Unified Communications Manager · Checked 2026-09-24
  12. 12
    The ITL file is created automatically when the TFTP service is activated at cluster install, and is rebuilt automatically when its content changes; no security feature has to be enabled for it.
    Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Default Security · Default Security chapter, Initial Trust List section · Checked 2026-09-24
  13. 13
    The CallManager certificate carried in the ITL lets the phone authenticate the ITL file signature and the phone configuration file signature.
    Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Default Security · Default Security chapter, Initial Trust List section, ITL records list (CallManager certificate) · Checked 2026-09-24
  14. 14
    The SBD technote gives the phone menu path Settings > Security Configuration > Trust List for manually deleting the ITL, noting that the path varies by phone model.
    Understand CUCM Security By Default and ITL Operation and Troubleshooting · FAQ: Can I easily delete the ITL file from all phones once the CallManager.pem is lost? · Checked 2026-09-24
  15. 15
    Cisco IP phones download the ITL file during a reset, a restart, or after downloading the CTL file.
    Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Default Security · Default Security chapter, Initial Trust List section · Checked 2026-09-24
  16. 16
    A phone with no CTL file trusts the first ITL file it receives automatically; a phone that has a CTL file uses the CTL to authenticate the ITL signature.
    Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Default Security · Default Security chapter, Initial Trust List section · Checked 2026-09-24
  17. 17
    utils itl reset localkey uses the ITLRecovery private key from the ITLRecovery.p12 file stored on the publisher.
    Unified Communications Manager ITL Enhancements in Version 10.0(1) · utils itl reset localkey section · Checked 2026-09-24
  18. 18
    utils itl reset takes the current ITL from the publisher, strips its signature, re-signs the contents with the ITLRecovery private key and copies the new ITL to the TFTP directories on all active TFTP nodes.
    Unified Communications Manager ITL Enhancements in Version 10.0(1) · ITL reset / bulk reset description · Checked 2026-09-24
  19. 19
    A bulk ITL reset with the CLI command utils itl reset is used when phones no longer trust the ITL file signer, to re-establish trust between phones and the Unified CM TFTP service.
    Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Default Security · Default Security chapter, Perform Bulk Reset of ITL File section · Checked 2026-09-24
  20. 20
    utils itl reset remotekey retrieves an ITLRecovery.p12 file from an external SFTP server and uses it in place of the local copy.
    Unified Communications Manager ITL Enhancements in Version 10.0(1) · utils itl reset remotekey section · Checked 2026-09-24
  21. 21
    After running the ITL reset command, the administrator resets devices from System > Enterprise Parameters > Reset so phones download the newly signed ITL file.
    Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Default Security · Default Security chapter, Perform Bulk Reset of ITL File procedure · Checked 2026-09-24
  22. 22
    In Release 15 the ITL file is signed by the ITLRecovery certificate.
    Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Default Security · Default Security chapter, Initial Trust List section, ITL records list (ITLRecovery certificate) · Checked 2026-09-24
  23. 23
    Unified CM Administration can filter phones by ITL File Status under Device > Phone, with values Match, MisMatch, Not Installed and Unknown.
    Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Default Security · Default Security chapter, Obtain ITL File Status section · Checked 2026-09-24
  24. 24
    The ITL carries TVS certificates so the phone can reach TVS securely; the CAPF certificate supports configuration file encryption but is not required in the ITL because TVS can authenticate it.
    Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Default Security · Default Security chapter, Initial Trust List section, ITL records list (TVS and CAPF certificates) · Checked 2026-09-24
  25. 25
    In Release 15 the ITLRecovery certificate validity is 20 years by default, configurable to 5, 10, 15 or 20 years, and the certificate is carried forward on upgrade.
    Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Default Security · Default Security chapter, ITL Recovery / ITLRecovery certificate section · Checked 2026-09-24
  26. 26
    As documented for 10.0(1), the ITLRecovery certificate had a five-year validity.
    Unified Communications Manager ITL Enhancements in Version 10.0(1) · ITL Recovery certificate discussion (validity) · Checked 2026-09-24
  27. 27
    The ITLRecovery key was introduced in Unified CM 10.0(1), is created during install or upgrade, and does not change when the hostname or DNS changes.
    Unified Communications Manager ITL Enhancements in Version 10.0(1) · Introduction / ITL Recovery key background · Checked 2026-09-24
  28. 28
    If DHCP does not supply a TFTP server address, the TFTP server must be configured locally on the phone, which then contacts it directly.
    Cisco IP Phone 8800 Series Administration Guide for Cisco Unified Communications Manager - Technical Details · Phone Startup Process, step Access TFTP Server · Checked 2026-09-24
  29. 29
    Mixed mode is enabled from the publisher CLI with utils ctl set-cluster mixed-mode, which updates the CTL file, and reverted with utils ctl set-cluster non-secure-mode.
    Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Security Modes · Security Modes chapter, enable mixed mode / revert procedures · Checked 2026-09-24
  30. 30
    Mixed mode, also called secure mode, supports both secure and non-secure endpoints in the same cluster.
    Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Security Modes · Security Modes chapter, overview · Checked 2026-09-24
  31. 31
    Before converting to mixed mode, Unified CM must be registered to Cisco Smart Software Manager or a satellite with a registration token that has Allow Export-Controlled functionality enabled.
    Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Security Modes · Security Modes chapter, mixed mode prerequisites · Checked 2026-09-24
  32. 32
    Converting to mixed mode requires the Cisco CAPF service and the Cisco CTL service to be activated on the publisher.
    Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Security Modes · Security Modes chapter, mixed mode prerequisites · Checked 2026-09-24
  33. 33
    The 8800 status message File not found <Cfg File> means the phone's configuration file is not present on the TFTP server.
    Cisco IP Phone 8800 Series Administration Guide for Cisco Unified Communications Manager - Monitoring Phone Systems · Monitoring Phone Systems, Status Messages table, row File not found <Cfg File> · Checked 2026-09-24
  34. 34
    The 8800 status message File Not Found <CTLFile.tlv> indicates the Unified CM cluster is not in secure (mixed) mode, so there is no CTL file to download.
    Cisco IP Phone 8800 Series Administration Guide for Cisco Unified Communications Manager - Monitoring Phone Systems · Monitoring Phone Systems, Status Messages table, row File Not Found <CTLFile.tlv> · Checked 2026-09-24
  35. 35
    The 8800 status message Phone failed to register. Cert key size is not FIPS compliant indicates an RSA certificate shorter than 2048 bits that must be replaced.
    Cisco IP Phone 8800 Series Administration Guide for Cisco Unified Communications Manager - Monitoring Phone Systems · Monitoring Phone Systems, Status Messages table, row Phone failed to register. Cert key size is not FIPS compliant · Checked 2026-09-24
  36. 36
    The 8800 status message No Trust List installed means neither a CTL nor an ITL file is installed on the phone.
    Cisco IP Phone 8800 Series Administration Guide for Cisco Unified Communications Manager - Monitoring Phone Systems · Monitoring Phone Systems, Status Messages table, row No Trust List installed · Checked 2026-09-24
  37. 37
    The 8800 status message TFTP timeout means the TFTP server did not respond, pointing to a network or TFTP server problem.
    Cisco IP Phone 8800 Series Administration Guide for Cisco Unified Communications Manager - Monitoring Phone Systems · Monitoring Phone Systems, Status Messages table, row TFTP timeout · Checked 2026-09-24
  38. 38
    The 8800 status message Trust List update failed means the CTL and ITL update did not succeed, pointing to a network or server-side problem.
    Cisco IP Phone 8800 Series Administration Guide for Cisco Unified Communications Manager - Monitoring Phone Systems · Monitoring Phone Systems, Status Messages table, row Trust List update failed · Checked 2026-09-24
  39. 39
    Cisco warns never to regenerate the CallManager.pem and TVS.pem certificates at the same time; after changing either, TFTP and TVS services are restarted and phones reset to pick up the new ITL.
    Understand CUCM Security By Default and ITL Operation and Troubleshooting · Regenerate Certificates section · Checked 2026-09-24
  40. 40
    Cisco's SBD technote states there is no Cisco-provided method to delete the ITL from all phones remotely; deletion is manual per phone, or a factory reset where the phone's settings access is restricted.
    Understand CUCM Security By Default and ITL Operation and Troubleshooting · FAQ: Can I easily delete the ITL file from all phones once the CallManager.pem is lost? · Checked 2026-09-24
  41. 42
    CAPF listens on TCP 3804 for issuing Locally Significant Certificates to IP phones.
    System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Cisco Unified Communications Manager TCP and UDP Port Usage · Table: Signaling, Media, and Other Communication Between Phones and Cisco Unified Communications Manager, row 3804 / TCP · Checked 2026-09-24
  42. 43
    TCP 6970 on the TFTP node serves HTTP-based download of firmware and configuration files, and TCP 6971 and 6972 provide an HTTPS interface to TFTP used for secure configuration file downloads.
    System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Cisco Unified Communications Manager TCP and UDP Port Usage · Table: Signaling, Media, and Other Communication Between Phones and Cisco Unified Communications Manager, rows 6970 TCP and 6971, 6972 / TCP · Checked 2026-09-24
  43. 44
    Phone registration signaling uses TCP 2000 for SCCP, TCP 2443 for secure SCCP, TCP and UDP 5060 for SIP, and TCP 5061 for secure SIP.
    System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Cisco Unified Communications Manager TCP and UDP Port Usage · Table: Signaling, Media, and Other Communication Between Phones and Cisco Unified Communications Manager, rows 2000, 2443, 5060, 5061 · Checked 2026-09-24
  44. 45
    Phones download firmware and configuration files from Unified CM TFTP on UDP 69, with the transfer continuing on an ephemeral port.
    System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Cisco Unified Communications Manager TCP and UDP Port Usage · Table: Signaling, Media, and Other Communication Between Phones and Cisco Unified Communications Manager, row 69 then Ephemeral / UDP · Checked 2026-09-24
  45. 46
    Phones reach the Trust Verification Service on Unified CM at TCP 2445.
    System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Cisco Unified Communications Manager TCP and UDP Port Usage · Table: Signaling, Media, and Other Communication Between Phones and Cisco Unified Communications Manager, row 2445 / TCP · Checked 2026-09-24
  46. 47
    A Cisco IP phone can register with Unified CM only if it has been added to the server database or autoregistration is enabled.
    Cisco IP Phone 8800 Series Administration Guide for Cisco Unified Communications Manager - Troubleshooting · Troubleshooting, Startup Problems, Unified Communications Manager Phone Registration · Checked 2026-09-24
  47. 48
    The registration troubleshooting technote refers to phone states Registered, Unregistered, Partially Registered, Rejected and Unknown, and notes a phone shown Unregistered on one node should be checked across nodes and RIS status.
    General Information for CUCM IP Phone Registration/Deregistration Troubleshooting · Registration status / RIS DC discussion · Checked 2026-09-24
  48. 49
    Setting the enterprise parameter Prepare Cluster for Rollback to pre-8.0 to True makes phones download a special ITL with empty TVS and TFTP certificate sections, after which they accept unsigned configuration files and any new ITL.
    Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Default Security · Default Security chapter, Migrate IP Phones Between Clusters section · Checked 2026-09-24
  49. 50
    For moving phones between clusters, the Release 15 Security Guide calls the Prepare Cluster for Rollback to pre-8.0 parameter the most preferred option.
    Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Default Security · Default Security chapter, Migrate IP Phones Between Clusters section · Checked 2026-09-24
  50. 51
    Security By Default gives supported Cisco IP phones a basic level of security with no extra configuration, including default TFTP file authentication, optional configuration file encryption and certificate verification.
    Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Default Security · Default Security chapter, Default Security Overview · Checked 2026-09-24
  51. 52
    Cisco's registration troubleshooting technote states phones will not register if they use a secure device security profile without an LSC installed.
    General Information for CUCM IP Phone Registration/Deregistration Troubleshooting · Registration prerequisites / common causes discussion · Checked 2026-09-24
  52. 53
    With SBD, phones request a signed configuration file named SEP<MAC>.cnf.xml.sgn, or SEP<MAC>.cnf.xml.enc.sgn when configuration encryption is in use.
    Understand CUCM Security By Default and ITL Operation and Troubleshooting · Phone downloads signed configuration file (file request examples) · Checked 2026-09-24
  53. 54
    The 2017 registration technote states the default Expires value in the phone's REGISTER to the primary Unified CM is 120 seconds, and that keep-alive REGISTERs to secondary servers carry Expires 0.
    General Information for CUCM IP Phone Registration/Deregistration Troubleshooting · SIP phone registration / KeepAlive discussion · Checked 2026-09-24
  54. 55
    On the 8800 series the Status Messages screen (Applications > Admin settings > Status > Status messages) shows the 30 most recent status messages the phone generated.
    Cisco IP Phone 8800 Series Administration Guide for Cisco Unified Communications Manager - Monitoring Phone Systems · Monitoring Phone Systems, Status Messages section · Checked 2026-09-24
  55. 56
    When a phone cannot verify a signature or certificate from its CTL or ITL, it contacts a TVS server to verify it.
    Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Default Security · Default Security chapter, Trust Verification Service section · Checked 2026-09-24
  56. 57
    The Trust Verification Service runs on Unified CM nodes and authenticates certificates on behalf of the phone, so the phone only needs to trust TVS instead of holding every trusted certificate.
    Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Default Security · Default Security chapter, Trust Verification Service section · Checked 2026-09-24
  57. 58
    Phones that do not support Security By Default are served a nonsigned default configuration file under autoregistration.
    Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Default Security · Default Security chapter, Autoregistration section · Checked 2026-09-24
  58. 59
    During startup, a Cisco IP Phone 8800 connected to a Cisco Catalyst switch is told the voice VLAN defined on the switch before it requests an IP address.
    Cisco IP Phone 8800 Series Administration Guide for Cisco Unified Communications Manager - Technical Details · Phone Startup Process, step Configure VLAN · Checked 2026-09-24
  59. 60
    When autoregistration is enabled and the phone has not been added to the Unified CM database, the phone fetches the default configuration file XmlDefault.cnf.xml from TFTP.
    Cisco IP Phone 8800 Series Administration Guide for Cisco Unified Communications Manager - Technical Details · Phone Startup Process, step Request Configuration File · Checked 2026-09-24

Documents

tier 2 current vendor documentation

Cisco IP Phone 8800 Series Administration Guide for Cisco Unified Communications Manager - Monitoring Phone Systems

Cisco Systems · 2025-11-06 · accessed 2026-09-24

tier 2 current vendor documentation

Cisco IP Phone 8800 Series Administration Guide for Cisco Unified Communications Manager - Technical Details

Cisco Systems · 2025-11-06 · accessed 2026-09-24

tier 2 current vendor documentation

Cisco IP Phone 8800 Series Administration Guide for Cisco Unified Communications Manager - Troubleshooting

Cisco Systems · 2025-11-06 · accessed 2026-09-24

tier 2 current vendor documentation

General Information for CUCM IP Phone Registration/Deregistration Troubleshooting

Cisco Systems · 2017-09-22 · accessed 2026-09-24

tier 2 current vendor documentation

Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Default Security

Cisco Systems · 2026-09-22 · accessed 2026-09-24

tier 2 current vendor documentation

Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Security Modes

Cisco Systems · 2026-09-22 · accessed 2026-09-24

tier 2 current vendor documentation

System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Cisco Unified Communications Manager TCP and UDP Port Usage

Cisco Systems · 2026-09-22 · accessed 2026-09-24

tier 2 current vendor documentation

System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure TFTP Servers

Cisco Systems · 2026-09-22 · accessed 2026-09-24

tier 2 current vendor documentation

Understand CUCM Security By Default and ITL Operation and Troubleshooting

Cisco Systems · 2023-07-14 · accessed 2026-09-24

tier 2 current vendor documentation

Unified Communications Manager ITL Enhancements in Version 10.0(1)

Cisco Systems · 2014-04-08 · accessed 2026-09-24

Cite this page

APA

WarmTransfer. (2026, September 24). Cisco IP phone registration and TFTP and ITL and CTL. WarmTransfer. https://warmtransfer.net/knowledge/cisco-phone-registration

BibTeX

@misc{warmtransfer-cisco-phone-registration,
  title  = {Cisco IP phone registration and TFTP and ITL and CTL},
  author = {{WarmTransfer}},
  year   = {2026},
  url    = {https://warmtransfer.net/knowledge/cisco-phone-registration},
  note   = {Verified 2026-09-24}
}