Cisco "Unsupported Transceiver": Which Error You Got Tells You Whether It's a Fake
Written and maintained by Haink's network infrastructure team · Error text taken from Cisco system message guides, 22 August 2026 · authorized-channel, serial-verified
A port rejects a transceiver and the assumption is always the same: the optic is counterfeit. Sometimes it is. Just as often the module is entirely genuine and the switch is running software that predates it, or the module is not supported on that particular platform.
The two cases look identical from across the room and completely different in the log. Cisco emits a different message for each, and reading which one you got answers the question before anyone opens a dispute with the supplier.
The messages, and what each one means
These are from Cisco's system message guides. The [chars] placeholder is the interface name as the switch prints it.
| Message | What Cisco says it means | Verdict |
|---|---|---|
GBIC_SECURITY_CRYPT-4-ID_MISMATCH: Identification check failed for GBIC interface [chars]. | The module identifies itself as Cisco but fails the authentication check | Counterfeit |
GBIC_SECURITY_UNIQUE-4-DUPLICATE_SN: GBIC interface [dec]/[dec] has the same serial number as another GBIC interface. | Serial number duplicated across two modules | Counterfeit |
GBIC_SECURITY_UNIQUE-3-DUPLICATE_GBIC | Vendor ID and serial match another interface | Counterfeit |
GBIC_SECURITY_CRYPT-4-UNRECOGNIZED_VENDOR: GBIC interface [chars] manufactured by an unrecognized vendor. | Vendor not in the switch's known list. Cisco's own recommended action includes upgrading software | Ambiguous |
GBIC_SECURITY-4-EEPROM_CRC_ERR / EEPROM_READ_ERR | Invalid or unreadable EEPROM data | Hardware fault |
PHY-4-CHECK_SUM_FAILED: SFP EEPROM data check sum failed for SFP interface [chars]. | Identified as Cisco but vendor data integrity not confirmed. Reseat; if it repeats the module is probably faulty | Hardware fault |
%PLATFORM_PM-6-MODULE_ERRDISABLE: The inserted SFP module with interface name GiX/Y/Z is not supported | Module not supported on this platform or software version | Incompatibility |
%PM-4-ERR_DISABLE: gbic-invalid error detected on GiX/Y/Z, putting GiX/Y/Z in err-disable state | The errdisable action that follows the above | Incompatibility |
A note on sourcing: the widely quoted %PHY-4-UNSUPPORTED_TRANSCEIVER does not appear in Cisco's public system message documentation — it lives in the Error Message Decoder, which requires a login. The messages above are all from published Cisco guides, which is why we quote those instead.
The decision, in order
- Is there a
GBIC_SECURITY_CRYPT-4-ID_MISMATCHor a duplicate serial? Then the module claims to be Cisco and cannot prove it. That is the counterfeit signature, and no software upgrade fixes it. Take it up with whoever sold it. - Is it
UNRECOGNIZED_VENDOR? Do not conclude anything yet. Cisco's own recommended action for this message is to check the supported list and upgrade software if needed — which means it fires on genuine modules that the running release does not know about. - Is it
MODULE_ERRDISABLEorgbic-invalidwith no security message? That is a platform or software support problem, not an authenticity problem. - Is it an EEPROM or checksum error? Reseat once. If it repeats, the module has damaged vendor data and the remedy is a replacement, whether or not it is genuine.
Check the switch before blaming the optic
One command settles the software question, and it is the step most people skip:
show interfaces transceiver supported-list
The output lists supported transceiver types and the minimum Cisco IOS-XE version required for each. If your part number is absent, or present with a version number above the one you are running, the module is fine and the switch is behind. A documented Cisco case has a genuine GLC-T failing on a Catalyst 3560CX purely because the platform needed IOS 15.2(5)E or later.
For the platform question — is this module supported on this switch at all — the authority is Cisco's Optics-to-Device Compatibility Matrix at tmgmatrix.cisco.com, now also reachable at optics.cisco.com. Cisco no longer publishes per-platform compatibility PDFs; they were consolidated into that tool.
Third-party optics: what Cisco actually says
Cisco's position is documented and consistent. From its SFP maintenance and troubleshooting document: "The use of third party SFP transceivers with Cisco devices is not supported by Cisco." From the ISR 1000 configuration guide: "Cisco does not provide any kind of support for the third-party SFPs because they are not validated by Cisco."
There is nevertheless a command that lets them run:
no errdisable detect cause gbic-invalid
service unsupported-transceiver
Entering it prints a warning that is worth reading in full, because it is the actual commercial risk stated in Cisco's own words:
"When Cisco determines that a fault or defect can be traced to the use of third-party transceivers installed by a customer or reseller, then, at Cisco's discretion, Cisco may withhold support under warranty or a Cisco support program. In the course of providing support for a Cisco networking product Cisco may require that the end user install Cisco transceivers if Cisco determines that removing third-party parts will assist Cisco in diagnosing the cause of a support issue."
Three practical notes. The command is hidden on many platforms — it does not appear under ?. It does not exist on some, including discussions around the Catalyst 2960L. And it is not a universal fix: in a documented case on a 3560CX, neither this command nor disabling the errdisable cause helped, because the real problem was the software version.
The honest position on third-party optics
They work, they are much cheaper, and the risk is not technical — it is that a support case involving that link can be refused, and that you may be asked to swap the optics out before Cisco will diagnose anything. For a link that will never be the subject of a TAC case, that trade is often rational. For a core uplink under a support contract, it converts a cheap component into an expensive argument at the worst possible moment.
Worth separating from counterfeiting, which is a different problem entirely. A third-party optic is honestly labelled as somebody else's product. A counterfeit claims to be Cisco. The first is a support decision; the second is a fraud you have already paid for — see gray-market and channel risk.
Recovering a port that went err-disable
errdisable recovery cause gbic-invalid
errdisable recovery interval 300
The relevant errdisable causes for optics are gbic-invalid and sfp-config-mismatch. The default recovery interval is 300 seconds. Note that recovery only helps if the underlying condition clears — it will loop indefinitely against a module the platform genuinely does not support.
A separate class of message: DOM threshold alarms
Messages about receive power warnings are frequently mistaken for compatibility errors and are not. They come from digital optical monitoring, which reports live optical power, temperature, laser bias and supply voltage against alarm and warning thresholds:
show interfaces <id> transceiver detail
Cisco's guidance on reading it: receive power persistently below the low warning threshold "indicate a problem with the transceiver at the other side" — so a power alarm points across the link, not at the module in front of you. Note also that DOM is not present on every module: the copper 1000BASE-T SFPs have none, and support varies by module and by software version.
What to ask your supplier
- The exact log line. A security-crypt message and a platform-support message are two different conversations.
- The output of
show interfaces transceiver supported-listfor the switch in question. - Whether the module is Cisco-branded or third-party — and if Cisco-branded, where it was sourced.
- For a suspected counterfeit, the serial number, so it can be checked.
Got an optic your switch will not accept?
Send the log line, the switch model and software version, and the transceiver part number. We tell you whether it is a fake, an incompatibility or a software version — and quote the correct module if you need one. No obligation, within one business day.
Frequently asked questions
Does an unsupported transceiver error mean the optic is counterfeit?
Not on its own. A GBIC_SECURITY_CRYPT-4-ID_MISMATCH or a duplicate serial number is the counterfeit signature. A MODULE_ERRDISABLE or gbic-invalid without a security message is a platform or software support problem, and genuine Cisco modules produce it routinely on older software.
What does service unsupported-transceiver do?
It allows transceivers that fail Cisco's authentication check to operate. It is hidden on many platforms and absent on some. Entering it prints Cisco's warning that support may be withheld where a fault traces to third-party optics.
Will Cisco refuse to support my switch if I use third-party optics?
Cisco states it does not support third-party SFPs, and reserves the right to withhold warranty or contract support where a fault can be traced to them — and to require Cisco optics be installed before diagnosis proceeds. In practice the risk applies to the link in question rather than the whole estate, but it is a real exposure on anything under contract.
How do I check whether my switch supports a specific transceiver?
Run show interfaces transceiver supported-list on the switch — it lists supported types with the minimum IOS-XE version for each. For the platform question, use Cisco's Optics-to-Device Compatibility Matrix at tmgmatrix.cisco.com.
My port went into err-disable. How do I bring it back?
Configure errdisable recovery cause gbic-invalid with a recovery interval. It only helps if the underlying condition is resolved — against a genuinely unsupported module the port will simply cycle.
Is a receive-power warning the same as an unsupported transceiver?
No. That is digital optical monitoring reporting against thresholds. Cisco's guidance is that persistent low receive power indicates a problem with the transceiver at the far end of the link.
Related
- Cisco optics compatibility — how to check before you order
- Cisco optics part numbers decoded — SR, LR, ER, the -S suffix and the rest
- Gray-market and channel risk — where counterfeit optics come from
- SmartNet versus warranty — what support you are risking
- Optic modules and transceivers · Cisco stock and lead times
Sources
- Cisco — system message guide (GBIC_SECURITY and PHY message text)
- Cisco — troubleshooting unsupported transceivers (errdisable behaviour, command sequence)
- Cisco — SFP transceiver maintenance and troubleshooting (third-party position)
- Cisco — third-party SFPs on ISR 1000
- Cisco — errdisable recovery
- Cisco — troubleshooting fibre links on Catalyst 9000 (DOM, supported-list)