• If you are citizen of an European Union member nation, you may not use this service unless you are at least 16 years old.

  • Finally, you can manage your Google Docs, uploads, and email attachments (plus Dropbox and Slack files) in one convenient place. Claim a free account, and in less than 2 minutes, Dokkio (from the makers of PBworks) can automatically organize your content for you.



Page history last edited by PBworks 13 years, 5 months ago

Unlock PAP2 Instructions (Crossover-cable method)

The following is a complete set of step-by-step unlock instructions for PAP2 v1, Firmware 3.1.7 and greater. Firmware 3.1.6 and less can be unlocked with a simpler method. PAP2 hardware version 2 is much different internally. A different thread and technique applies to it.


These instructions are based on posts scattered throughout the bargainShare.com Linksys PAP2 Unlock Info thread. IVR (Interactive Voice Response) codes and related links are listed in the Appendix at the bottom of this page.



The core of the PAP2 is a small computer within, a pre-programmed microprocessor and I/O system that will seek out a connection to Vonage.com when an Internet connection is available to it. Initial maintenance such as firmware upgrading will occur at this time, as well as registration if an account has been established.


This procedure is based on mimicking this normal activity that only occurs when a new PAP2 is connected to the Internet for the first time. Once this initial activity has been preformed successfully by the PAP2 to Vonage, it will not be repeated. The procedure described here depends on the PAP2 being ready to preform this initial activity. Therefor, this brings up a very important point: The new unit MUST NOT be connected to the internet, even briefly, prior to this procedure or the unit will then be locked, or "bricked", as this condition is termed. So, Do not connect your new unit to the Internet yet. This means a computer, a router or a modem hooked to the internet, or any computer with a wireless card!!!



Provide the following items [based on Post #120]:

  • PAP2 v1 (top of box is orange) firmware version 3.1.7 to 3.1.9 – not previously connected to Internet.
  • PC running XP Home or Pro with an Ethernet port (NIC) - Note: Windows 2000 does not do ICS (DNS) quite right for this procedure.
  • Ethernet crossover cable. The following make-do's are possible if not available:
    • A switch (or router with DHCP off, and using only its LAN connections) and 2 cables can be used as a clumsy substitute.
    • Make your own from a regular cable by swapping the green pair and orange pair(most cables) - cut cover, fold, cut wires, strip, twist.
  • Sipura SPA-2000 Firmware – pap2sp2kzip3vn.zip and sp2kpap2zip1pm.zip  - must right click, then save. Rename extensions to .ZIP . [from  Post #3, Step 3]. Comment: one user had to use IE. It would not dl with Firefox. 12/16/07 Tested dl  with Netscape SeaMonkey and Firefox OK..
  • TFTP Server – free from SolarWind http://www.solarwinds.com/downloads/
  • HTTP Server. Choose ONE of these:
    • SHTTPD - Preferred for size and ease of use. Freeware. http://shttpd.sourceforge.net/
      • [Note:  testing of SHTTPD revealed an issue in this application. However, a similar product, "wxWebserver" tested OK. No log, though. Stay tuned.]
    • IIS - free MS add-on. Only works for XP PRO. Specific instructions for IIS are not included here.
  • An additional data connection to allow Windows ICS, Internet Connection Sharing, to activate. Choose ONE of these:
    • an existing wireless port.
    • install a 2nd Ethernet card(NIC) - What I did, Fry's sale 99 cents. XP will usually auto install it.
    • A Virtual port. It acts like another physical port , but is software only. OpenVPN is suggested if a virtual port is needed, free at http://openvpn.net/download_action.php?ope...0.9-install.exe


Factory reset your PAP2 [from Post #120 step1]:

  1. Connect power only, then
  2. Connect a simple telephone to LINE1
  3. Enter IVR mode by dialing: ****
  4. Enter the command: 73738# (i.e. R E S E T #)
  5. If you're prompted to "Press 1 to confirm," do so (password is not required)
  6. If you're prompted for password, enter one of the "known/common" Vonage USER Passwords:
    • 78196365
    • 50274537
    • 7756112
    • 8995523
    • 5465866
  7. Press the # key after entering a password
  8. Repeat the preceeding two steps until one of the passwords works or you've exhausted the list


Get your PAP2 MAC address

  1. Enter the IVR command: 140#


Save your PAP2 information in notepad so that you can copy & paste and avoid typos. For example, my_PAP2_info.txt looks like this:

  1. MAC address: 00123456789A
  2. password: 7756112

Note: whenever you see <MAC> as part of a file or folder name, translate it to your PAP2's MAC address.


Get the unique encrypted XML file available for each PAP2 unit. Obtain this file by the following procedure [from Post #21]:

  1. with computer internet access, open a command window ( start/run/cmd )
  2. cd to a convenient folder and note the location to retrieve the downloaded file later.
  3. Copy and paste the following in the command line:

    tftp -i ls.tftp.vonage.net GET //spa<MAC>.xml

  4. Replacing the above <MAC> with your PAP2's MAC address.
  5. Make sure no firewall is blocking internet access. Press "enter".
  6. The file "spa<MAC>.xml will downloaded to the command folder in use. It will be about 30K bytes. In the sample unit above, the file name would be spa00123456789a.xml. It is referred to as "Your Encrypted XML file". Once this file and the other files above have been obtained, no additional internet access is required.



[based on Post #326] and additions:


TFTP Server:

  1. Install SolarWind TFTP Server
  2. configure it to both transmit and receive files
  3. The default folder it creates is C:\TFTP-Root. It will be used for most files.


HTTP Server:

  1. Unzip SHTTPD.zip and extract shttpd.exe to C:\TFTP-Root [There is an issue with SHTTPD in this app.(404 error) I used the very similar "wxWebServer"  instead, and it worked fine. No log, though. Stay tuned. ]

    wxWebSrever defaults to port 8080; change that to port 80.

  2. click on it to run,

  3. click on the new green clover in the tray, set to autostart so it will be running if you reboot. Note. don't depend on autostart.


Placing Unlocking Files:

Note: <MAC> is your own 12 character MAC address [ref Post #120, step 7]
  • Your encrypted XML file:
    • Copy your encrypted XML file, obtained in the preparation section, into C:\TFTP-root. You now have C:\TFTP-root\spa<MAC>.xlm
  • PAP2 to Sipura mode file ( firmware that temporarily converts unit to partial Sipura state)
    • make a new folder in C:\TFTP-root. Name it +<MAC> e.g C:\TFTP-root\+<MAC>
    • Unzip pap2sp2kzip3vn.zip and rename file as PAP2-bin-03-01-09-LSc.bin
    • copy it to the new sub-folder e.g. C:\TFTP-root\+<MAC>\PAP2-bin-03-01-09-LSc.bin
    • Make a 2nd copy of the file as C:\TFTP-root\PAP2-SP2K.bin
  • Sipura to PAP2 ver 3.1.6 firmware:
    • Unzip file sp2kpap2zip1pm.zip extract bin file to C:\TFTP-root and re-name it sp2k-pap2.bin for consistancy with this and most other guides.
  • Plain-text spa<MAC>.xml file - Made with notepad. It clears pw's, etc.
    • This simple file will be created later, since it will have the same name as "your Encrypted XML File"


DNS/DHCP Servers:

DNS/DHCP Servers are part of XP's built-in Internet Connection Sharing (ICS). In order to activate ICS, XP requires two Local Area Connections. XP already has one Local Area Connection if the PC is connected to a Network or the Internet. A second Local Area Connection can come from an existing wireless port, from a second NIC, or from a virtual connection (OpenVPN). Do only ONE of these:

  • Existing wireless port:
    • Share connection OTHER THAN the Ethernet connection. This will make the one Ethernet connection available at
  • OR add a 2nd NIC:
    • Share the original NIC connection and the other becomes the port available at The computer will then work as usual after you are done - without re-configuring. Simply re-connect to the Internet.
  • OR add a virtual connection:
    • Install the OpenVPN software. The act of installing OpenVPN creates a second Local Area Connection. Share the virtual connection. This will make the one Ethernet connection available at
In any case, you will be using the connection that is NOT checked share.


ICS activate:

Note settings before making changes so they can be set back after you are done.

Hint:The connections can be easily re-named to avoid confusion

Control Panel > Network Connections

  • Should have 2 connections shown.
  • click  Local Area Connection (~ the one to be shared, and not used here):
  • Advanced tab: check the  "Allow other network..." box
  • General tab: Internet Protocol (TCP/IP) > Properties>
  • Should be unconnected and show:
    • Obtain an IP address automatically
    • Obtain DNS server address automatically
  • Retire the open properties panels
  • Click on  Local Area Connection (~whatever) - the connection to be used
    • General tab: Internet Protocol (TCP/IP) > Properties>
    • Shows:


      • "Use the following iP address" - values here are auto-installed by ICS
      • "use the following DNS server address"

DNS redirect using hosts file:

This routes PAP2 vonage requests to local files.

  1. Make backup copy of C:\Windows\system32\drivers\etc\hosts
  2. Open the hosts file with NotePad and add the following two lines to the end of the file: ls.tftp.vonage.net httpconfig.vonage.net



Verify that there is no live internet connection or ISP configuration.

  1. If using 2 NICS, double check now that there is NO INTERNET CONNECTION to the other NIC!! If your other port is a wireless connection, assure that your access point is disabled and that no nearby WIFI signal has inadvertantly connected you to the internet !!!
  2. From command line: ipconfig/all to inspect your configuration


UNLOCK - Stage 1

  1. Connect the PAP2 to the PC's ethernet port with a crossover cable
  2. Power on the PAP2
  3. Wait 1 minute and PAP2 should have two steady blue lights
  4. Start SHTTPD
  5. Start SolarWinds. SolarWinds should be listening to (lower right corner)
  6. Power cycle the Linksys-mode PAP2. The PAP2 boot sequence should be as follows:
    • After a few minutes PAP2 makes a TFTP request. This can be verified from SolarWinds' main window indicating that PAP2 grabed the ENCRYPTED spa<MAC>.xml file.
    • Then PAP2's BLUE LEDs FLASH RAPIDLY for 5-10 seconds, indicating that the PAP2 is processing the spa<MAC>.xml file.
    • Then PAP2 sends an HTTP REQUEST to the HTTP server for the SPA2K firmware file, PAP2-bin-03-01-09-LSc.bin. This can be verified from the SHTTPD log panel.
  7. PAP2's indicator light should turn RED, indicating successful processing of the SPA2K firmware file. [continuing on Post #120 STEP #7]


UNLOCK - Stage 2

Strong provisioning rules are still prohibiting free access, but the "guts" of the PAP2 have now been changed, allowing an unencypted plain-text provisioning file to be read into the unit.

  1. Copy and paste the following section of text into NOTEPAD:


        <Admin_Passwd ua="na">4321</Admin_Passwd>

        <Enable_Web_Server ua="na">Yes</Enable_Web_Server>

        <Web_Server_Port ua="na">80</Web_Server_Port>

        <Enable_Web_Admin_Access ua="na">Yes</Enable_Web_Admin_Access>

        <Protect_IVR_FactoryReset ua="na">No</Protect_IVR_FactoryReset>

        <User_Password ua="na">1234</User_Password>

  2. Name this file spa<MAC>.xml ( replacing <MAC> with your unit's MAC #), and using ANSI encoding (not UNICODE)!!!
  3. Save this file to the C:/TFTP-Root folder, replacing the "encrypted" spa<MAC>.xml
  4. Power cycle the PAP2
  5. Check the TFTP Server's log to see that the plain text spa<MAC>.xml file (created in SETUP) was grabbed. If the TFTP Server's log shows a FILE NOT FOUND error message, and if the file attempting to be grabbed was requested from an obscurely named sub-directory (i.e. /a12BcdeFgH/spa<MAC>.xml), create that sub-directory (a12BcdeFgH) underneath the TFTP Root and move (or copy) the spa<MAC>.xml file to that sub-directory. Then re-Power Cycle the PAP2 and re-check the TFTP Server's log.
The unit is unlocked and in Sipura mode. The unit is still vulnerable to "bricking" by an internet connection. The rest of the work will be done directly through the unit's web interface.


UNLOCK - stage 3

Operational firmware and manual provisioning are next. [continuing on Post #326 UNLOCK PROCESS]

  1. Get the IP address of PAP2 web-interface:
    • Dial * * * *
    • Enter: 110#
  2. IP address of PAP2 web-interface should be 192.168.0.xxx
  3. Put "http://192.168.0.xxx/" in browser's address bar
  4. Login as user
    • User Name: user
    • Password: 1234
  5. PAP2 web-interface comes up
  6. Switch to Admin Login, link near the top-right.
    • User Name: admin
    • Password: 4321
  7. [continuing on Post #4 Basic Firmware Update Instructions]
  8. Click the "Advanced" button near the top-right. This will show the Provisioning Tab.
  9. Click the PROVISIONING tab and set
    • DNS addresses=
    • admin password=blank.
    • Click "Submit All Changes".
  10. Copy the following address into the browser's address bar.


    note: this browser line is addressed to the PAP2 at 192.168.0.XX. It commands the pap2 to do an upgrade using the TFTP server at . The file to be served is in the ROOT directory of that server and the address shown relects this, though the file is NOT in the root directory of the computer.

  11. Done, almost. Your Linksys PAP2 will eventually reboot (2 blue LEDs) (BE PATIENT) and you can click the "admin login" near the top-right. No password needed.
  12. From admin login, go to advanced mode and provision tab. Examine this page for the presence of the factory  gpp_k value, the unit's encryption key. It will be a 44 character alphanumeric base64 string ending with "=". If it is there, extract that key and save it,  you are done. If it is absent ( a different type of string (hex) or is blank) you should retrieve the factory key. Without this key, the unit can be permanently "bricked" If the unit is inadvertently reset while connected to the internet.



[continuing on Post #325 step 9]

  1. Remove the spa<MAC>.xml file from C:/TFTP-Root
  2. Factory Reset
    • enter IVR mode by dialing: * * * *
    • enter 73738#
  3. [continuing on Post #4]
  4. Power cycle the PAP2 (not needed??)
  5. Type the IP address of the PAP2 adapter into your web browser to get to the configuration page (see IVR code in appendix if you need the IP address)
  6. In SYSTEM, set a User password of 1234
  7. Click the SAVE SETTINGS button.
  8. Refresh the link (you login with user and 1234)
  9. Copy the following address into the browser's address bar


  10. Examine the status leds. Power should turn RED when it is done. Give it a minute or two, dont interrupt it.
  11. Once red, point browser at your PAP2. (our IP in this example is
  12. Click the "admin login" link near the top-right.
  13. Click the "Advanced" button near the top-right. This will show the Provisioning Tab.
  14. Click the PROVISIONING tab.
  15. Set PROVISION ENABLE=NO and click "Submit All Changes".
  16. Copy the following address into the browser's address bar, and modify to include your TFTP server's IP address.


  17. Done. Your Linksys PAP2 will eventually reboot (2 blue LEDs, BE PATIENT) and you can click the "admin login" near the top-right. No password needed.
  18. Put http://192.168.0.xxx/ in browser's address bar and the PAP2 web-interface comes up
  19. Switch to Admin Login > "Advanced" mode > "Provisioning" tab >
  20. extract the GPP_K value and save it.
  21. Make sure you got the FACTORY FRESH GPP_K value. Attributes are:
    • 44 characters long
    • Comprised of alpha (A-Z, a-z), numeric (0-9), and symbols
    • Ends with an EQUAL SIGN (=)



If there is a chance of Unlocking PAP2 another time, disable the effects of OpenVPN, IIS, and SolarWinds as decribed in at the end of Post #1332.

If you will not be Unlocking any more PAP2s, you can unistall the software and settings:

  1. Remove Local Area Connection 2
    • OpenVPN > Delete all TAP-Win32 virtual Ethernet adapters
  2. Restore values for Local Area Connection
  3. Restore original copy of C:/Windows/System32/Drivers/etc/hosts
  4. Re-enable any/all firewalls, antivirus, antispyware, etc.
  5. Uninstall programs that were not installed before:
    • OpenVPN
    • SolarWind TFTP Server
    • shttpd




IVR (Interactive Voice Response)

To enter IVR mode, connect a phone to the PAP2 and dial: * * * *. Then enter an IVR code:

  • 110# --- Current IP address of PAP2
  • 140# --- MAC Address of PAP2
  • 150# --- firmware version of PAP2
  • 73738# --- factory reset the PAP2 (USER password needed)


Administration Guide

Linksys PAP2 and RT31P2 PHONE ADAPTER Administration Guide (pdf) has a sections on:

  • 1.1.2. Provisioning Overview
  • 2.1. Phone Adapter LED Status (meaning of indicator lights)
  • 3. Software Configuration Mechanism
  • 3.4.1 If the value of "upgrade enable" parameter in Provisioning tab is no, you cannot upgrade the PHONE ADAPTER

Comments (0)

You don't have permission to comment on this page.