Cisco ASR903 – BiDi Optical Transceivers

Problem

When you install a BiDi (BX-U / BX-D) or other third-party SFP transceiver in a Cisco ASR903, the router may log the following warning:

GBIC_SECURITY_CRYPT-4-ID_MISMATCH: Identification check failed for GBIC in port 8

This syslog message means the ASR903’s GBIC security subsystem could not cryptographically verify the transceiver as a genuine Cisco-certified module. Third-party and BiDi SFP modules trigger this because they do not carry Cisco’s authentication credentials in their EEPROM. The affected port may be placed into errdisable state, taking the link down.

Prerequisites

IOS-XE 3.x or later on the ASR903 (verify with show version). The service unsupported-transceiver command availability depends on your IOS-XE release — confirm with service unsupported-transceiver ? in config mode.

Privilege level 15 (enable mode) access to the router.

If using BiDi SFPs: confirm you have matched pairs — BX-U on one end and BX-D on the other. Installing the same variant on both ends of a link will result in no connectivity even after applying the fix below.

Solution

Enter global configuration mode and apply the following commands:

enable
configure terminal

Step 1 — Allow third-party transceivers:

service unsupported-transceiver

This tells IOS-XE to accept transceivers that fail Cisco’s cryptographic authentication check.

Step 2 — Prevent ports from entering errdisable:

no errdisable detect cause gbic-invalid

This stops the router from shutting down ports when it detects a non-authenticated GBIC/SFP module.

Step 3 — Enable error recovery as a fallback:

errdisable recovery cause gbic-invalid
errdisable recovery interval 300

If a port was already in errdisable state before Step 2, this enables automatic recovery every 300 seconds (the default interval). Using cause gbic-invalid instead of cause all limits the scope to GBIC-related events only.

Step 4 — Save the configuration:

end
copy running-config startup-config

Without this step, all changes will be lost on the next router reload.

Step 5 — Verify the fix:

show interfaces transceiver
show log | include GBIC

Confirm the transceiver is enumerated and no new GBIC_SECURITY_CRYPT warnings appear. For BiDi links, also verify the link is up with show interfaces [interface-id] status.

Important Notes

BiDi wavelength pairing: BX-U transmits at 1310 nm and receives at 1490 nm. BX-D is the reverse. Always install complementary pairs on opposite ends of the fiber. Two BX-U or two BX-D modules on the same link will not establish a connection.

Scope of the fix: The service unsupported-transceiver command and no errdisable detect cause gbic-invalid apply to all ports on the router, not just BiDi ports. Any third-party transceiver in any slot will be accepted after this change.

Platform applicability: While this article targets the ASR903, the same commands and behavior apply to other Cisco IOS-XE platforms including the ASR920, NCS520, and Catalyst 9000 series.