Handling GBIC_SECURITY_CRYPT-4-ID mismatch error with BiDi Modules in ASR 900 Series

When installing BiDi (BX-U/BX-D) optical transceivers into Cisco ASR 900 series routers—such as the ASR903—you may encounter the following alarm:

GBIC_SECURITY_CRYPT-4-ID_MISMATCH: GBIC_SECURITY_CRYPT-4-ID_MISMATCH: Identification check failed for GBIC in port

This alarm indicates that the equipment recognizes the inserted module as a Cisco-compatible SFP, but the specific SFP type is not supported on the platform with the current software version. This situation frequently arises with BiDi modules like BX-U (upstream) or BX-D (downstream), which may not be supported across all Cisco platforms or software versions.

To check if the current SFP is supported under the Cisco platform, you can use the Cisco Compatibility Matrix.

Resolution

To ensure these modules remain operational and are not automatically disabled by the Cisco system, you can use the following commands:

service-unsupported transceiver


Additionally, to avoid port shutdowns and enable automatic recovery, apply these optional but recommended commands:

service-unsupported transceiver
errdisable recovery cause all
errdisable recovery interval 30