How to update firmware Cisco IP Phone 7942 with TFTP and FortiGate DHCP Server

I have:
- a new Cisco IP Phone 7942 after hard reset
- a new firmware version 9.4(2)SR3 for my phone (download from Cisco support center, login in need)
- a free TFTP server based on tftpd64.exe (http://tftpd32.jounin.net/tftpd32_download.html)
- a Fortigate FD100 device as DHCP server

And I need upgrade firmware. When IP Phone is booting he request IP address and address of TFTP server when is firmware placed.

1. First step - run the tftpd64.exe and set Current Directory with unpacked firmware (see folder contains below). And set interface for service listening.

2. Second step - configure Fortigate FD100 for DHCP server and config option 150

FG100 # show system dhcp server 4

config system dhcp server

    edit 4

        set default-gateway 192.168.5.1

        set netmask 255.255.255.0

        set interface "VOIP_VLAN_5"

        config ip-range

            edit 1

                set start-ip 192.168.5.10

                set end-ip 192.168.5.254

            next

        end

        set timezone-option default

        config options

            edit 1

                set code 150

                set value "C0A80511"

            next

        end

        set dns-server1 192.168.5.5

        set dns-server2 8.8.8.8

    next

end

This can you add via web interface. If I add pre configured option on FD, this dont work and I great a manual option with number 150 and add a HEX IP address of my TFTP server. HEX calculating using - http://ncalculators.com/digital-computation/ip-address-hex-decimal-binary.htm

3. Boot IP Phone and wait...

If you configured all fine the phone get IP address and start the process of upgrade:

Troubleshoting.

The biggest problem is optin 150. If you add this option correctly ont the side of TFTP Server you can see traffic from phone and can check error... See below:

This indicates that option set correctly byt need check the folder and files of firmware

Fortigate - работаем с политиками

Очередность политик важна. Если траффик попал под критерии политики 6, то к политики 7 его обработка не дойдет.

Посмотреть очередность и Policy-ID для политик:
show firewall policy

Fortigate FAQ

По умолчанию port1 настроен - 192.168.1.99/24. Включаемся витой парой к ПК и получаем адрес. Конфигурацию можно проводить с Web-интерфейса.

CLI commands - http://platforms.infostruction.com/fortinet-firewall-cli-commands/
Лучшая практика по конфигурации - http://docs.fortinet.com/uploaded/files/1954/Best_Practices_52.pdf