H3C SecPath NSQM1F1KGM0 User manual

H3C SecPath Firewall
Network Data Encryption Modules Manual
New H3C Technologies Co., Ltd.
http://www.h3c.com
Document version: 6W101-20201210

Copyright © 2020, New H3C Technologies Co., Ltd. and its licensors
All rights reserved
No part of this manual may be reproduced or transmitted in any form or by any means without prior written
consent of New H3C Technologies Co., Ltd.
Trademarks
Except for the trademarks of New H3C Technologies Co., Ltd., any trademarks that may be mentioned in this
document are the property of their respective owners.
Notice
The information in this document is subject to change without notice. All contents in this document, including
statements, information, and recommendations, are believed to be accurate, but they are presented without
warranty of any kind, express or implied. H3C shall not be liable for technical or editorial errors or omissions
contained herein.
Environmental protection
This product has been designed to comply with the environmental protection requirements. The storage, use,
and disposal of this product must meet the applicable national laws and regulations.

Preface
This manual describes the specifications and installation procedure for the network data encryption
modules.
This preface includes the following topics about the documentation:
•
Audience.
•
Conventions.
•
Documentation feedback.
Audience
This documentation is intended for:
•
Network planners.
•
Field technical support and servicing engineers.
•
Network administrators working with network data encryption modules.
Conventions
The following information describes the conventions used in the documentation.
Command conventions
Convention
Description
Boldface Bold text represents commands and keywords that you enter literally as shown.
Italic Italic text represents arguments that you replace with actual values.
[ ] Square brackets enclose syntax choices (keywords or arguments) that are optional.
{ x | y | ... }
Braces enclose a set of required syntax choices separated by vertical bars, from which
you select one.
[ x | y | ... ]
Square brackets enclose a set of optional syntax choices separated by vertical bars,
from which you select one or none.
{ x | y | ... } *
Asterisk marked braces enclose a set of required syntax choices separated by vertical
bars, from which you select a minimum of one.
[ x | y | ... ] *
Asterisk marked square brackets enclose optional syntaxchoices separated byvertical
bars, from which you select one choice, multiple choices, or none.
&<1-n> The argument or keyword and argument combination before the ampersand (&) sign
can be entered 1 to n times.
# A line that starts with a pound (#) sign is comments.
GUI conventions
Convention
Description
Boldface Window names, button names, field names, and menu items are in Boldface. For
example, the New User window opens; click OK.
> Multi-level menus are separated by angle brackets. For example, File > Create >
Folder.

Symbols
Convention
Description
WARNING! An alert that calls attention to important information that if not understood or followed
can result in personal injury.
CAUTION:
An alert that calls attention to important information that if not understood or followed
can result in data loss, data corruption, or damage to hardware or software.
IMPORTANT:
An alert that calls attention to essential information.
NOTE:
An alert that contains additional or supplementary information.
TIP:
An alert that provides helpful information.
Network topology icons
Convention
Description
Represents a generic network device, such as a router, switch, or firewall.
Represents a routing-capable device, such as a router or Layer 3 switch.
Represents a generic switch, such as a Layer 2 or Layer 3 switch, or a router that
supports Layer 2 forwarding and other Layer 2 features.
Represents an access controller, a unified wired-WLAN module, or the access
controller engine on a unified wired-WLAN switch.
Represents an access point.
Represents a wireless terminator unit.
Represents a wireless terminator.
Represents a mesh access point.
Represents omnidirectional signals.
Represents directional signals.
Represents a security product, such as a firewall, UTM, multiservice security
gateway, or load balancing device.
Represents a security module, such as a firewall, load balancing, NetStream, SSL
VPN, IPS, or ACG module.
Examples provided in this document
Examples in this document might use devices that differ from your device in hardware model,
configuration, or software version. It is normal that the port numbers, sample output, screenshots,
and other information in the examples differ from what you have on your device.
T
T
T
T

Documentation feedback
You can e-mail your comments about product documentation to inf[email protected].
We appreciate your comments.

i
Contents
About the encryption modules ·······································································1
Specifications ································································································1
LED ···············································································································3
Compatible hardware and software ·······························································4
NSQM1F1KGM0················································································································································4
NSQM1F1KGMB················································································································································4
NSQM1F1KGMC ···············································································································································5
NSQM1F5KGM0················································································································································6
NSQM1F5KGMC ···············································································································································6
NS-HTIM-GMG2A··············································································································································6
NS-HTIM-GMG2B··············································································································································7
Installing the encryption modules···································································7
Installing an NSQM1F1KGM0 encryption module ·····························································································7
Installing an NSQM1F1KGMB or NSQM1F1KGMC encryption module····························································8
Installing an NSQM1F5KGM0 or NSQM1F5KGMC encryption module ····························································9
Installing an NS-HTIM-GMG2A or NS-HTIM-GMG2B encryption module·······················································10
Functionalities······························································································10
Application scenarios···················································································11

1
About the encryption modules
The NSQM1F1KGM0, NSQM1F5KGM0, NSQM1F1KGMB, NSQM1F1KGMC, NSQM1F5KGMC,
NS-HTIM-GMG2A, and NS-HTIM-GMG2B are network data encryption modules developed by H3C.
The encryption modules provide the following functionalities:
•
Support rapid generation of random numbers, SM1 fast grouping algorithm, and SM2 public key
encryption algorithm.
•
Provide rich security features including keymanagement, digital signature and verification, data
encryption and decryption, and data integrity protection.
•
Offers high-performance and reliable data encryption for the IPsec module.
Specifications
Figure 1 NSQM1F1KGM0
(1) Captive screw
(2) Ejector lever
(3) LED (READY)
Figure 2 NSQM1F1KGMB
(1) Captive screw
(2) Ejector lever
(3) LED (READY)
Figure 3 NSQM1F1KGMC
(1) Captive screw
(2) Ejector lever
(3) LED (READY)
123
13
2
132

2
Figure 4 NSQM1F5KGM0
(1) Captive screw
(2) Ejector lever
(3) LED (READY)
Figure 5 NSQM1F5KGMC
(1) Captive screw
(2) Ejector lever
(3) LED (READY)
Figure 6 NS-HTIM-GMG2A
(1) Captive screw
(2) LED (READY)
(3) Ejector lever
Figure 7 NS-HTIM-GMG2B
(1) Captive screw
(2) LED (READY)
(3) Ejector lever
1 32
13
2
12 3
123

3
Table 1 Technical specifications
Model
Specifications
Dimensions
(H × W × D)
Max
power
consum
ption
Weight Hot
swapping Temperature Humidity
NSQM1
F5KGM
0
40.1 × 399.2 ×
195.8 mm
(1.58 × 15.72 ×
7.71 in)
3.95 W 1.44 kg
(3.17 lb)
Not
supported
•Operating:
0°C to 45°C
(32°F to
113°F)
•Storage: –
40°C to
+70°C (–
40°F to
+158°F)
•Operating
: 10% RH
to 80%
RH,
nonconde
sing
•Storage:
5% RH to
95% RH,
nonconde
sing
NSQM1
F5KGM
C
40.1 × 399.2 ×
195.8 mm
(1.58 × 15.72 ×
7.71 in)
5.5 W 1.34 kg
(2.95 lb)
NSQM1
F1KGM
0
40.1 ×150 ×
172.9 mm
(1.58 × 5.91 ×
6.81 in)
4.14 W 0.64 kg
(1.41 lb)
NSQM1
F1KGM
B
19.8 × 150 ×
172.9 mm
(0.78 × 5.91 ×
6.81 in)
3.7 W 0.36 kg
(0.79 lb)
NSQM1
F1KGM
C
19.8 × 150 ×
172.9 mm
(0.78 × 5.91 ×
6.81 in)
5.7 W 0.38 kg
(0.84 lb)
NS-HTI
M-GMG
2A
40.1 × 189.0 ×
212.4 mm
(1.58 × 7.44 ×
8.36 in)
7 W 0.6 kg
(1.32 lb)
NS-HTI
M-GMG
2B
40.1 × 189.0 ×
212.4 mm
(1.58 × 7.44 ×
8.36 in)
7 W 0.6 kg
(1.32 lb)
LED
The encryption modules each provide a LED to show their operating status.
Table 2 LED description
Mark
Status
Description
READY
Steady green The module has normal power input and is being initialized.
Flashing green (1 Hz) The module is operating correctly.
Off/steady yellow No power is present or the module is faulty.

4
Compatible hardware and software
NSQM1F1KGM0
Table 3 Compatible hardware and software for the NSQM1F1KGM0 encryption module
Compatible firewalls
Compatible slots
Software version
•F1020, F1030, F1050, F1060, F1070, F1080
•F100-A-G2, F100-A-EI, F100-E-G2, F100-A-SI,
F100-E-EI
•F1000-C-G2, F1000-C-EI, F1000-E-G2,
F1000-S-G2, F1000-A-G2
•F1020-GM, F1030-GM, F1070-GM, F1070-GM-L
•F1000-AK130, F1000-AK135, F1000-AK140,
F1000-AK145, F1000-AK150, F1000-AK155,
F1000-AK160, F1000-AK165, F1000-AK170,
F1000-AK175, F1000-AK1212, F1000-AK1222,
F1000-AK1232, F1000-AK1312, F1000-AK1322,
F1000-AK1332, F1000-AK180, F1000-AK185,
F1000-GM-AK370, F1000-GM-AK370
•F1000-AI-20, F1000-AI-30, F1000-AI-50
•F1000-920-AI, F1000-930-AI, F1000-950-AI,
F1000-960-AI, F1000-970-AI, F1000-980-AI,
F1000-990-AI
•F1000-E-VG, F1000-V70
•F100-A-G3, F100-E-G3, F100-A80-WiNet
Slot 1 R9333 or higher
•F1000-AI-60
•F1000-C-G3 Slot 1
E8601P07 or higher
•F1090
•F1000-AI-70, F1000-AI-80, F1000-AI-90
•F1000-S-G3, F1000-A-G3, F1000-E-G3
•F1000-AK1414, F1000-AK1424, F1000-AK1434,
F1000-AK1514, F1000-AK1524, F1000-AK1534,
F1000-AK1614
Slots 1 and 3
NSQM1F1KGMB
Table 4 Compatible hardware and software for the NSQM1F1KGMB encryption module
Compatible firewalls
Compatible slots
Software version
•F1020
•F100-A-G2, F100-A-EI
•F1000-AK130
•F1020-GM
•F1000-920-AI
•F100-A-G3
•F100-A80-WiNet
Slot 1
R9345 or higher
•F1030, F1050, F1060, F1070, F1080
•F100-E-G2, F100-A-SI, F100-E-EI
•F1000-C-G2, F1000-C-EI, F1000-E-G2,
Slots 1 to 2

5
Compatible firewalls
Compatible slots
Software version
F1000-S-G2, F1000-A-G2
•F1000-AK135, F1000-AK140, F1000-AK145,
F1000-AK150, F1000-AK155, F1000-AK160,
F1000-AK165, F1000-AK170, F1000-AK175,
F1000-AK1212, F1000-AK1222, F1000-AK1232,
F1000-AK1312, F1000-AK1322, F1000-AK1332,
F1000-AK180, F1000-AK185,
F1000-GM-AK370, F1000-GM-AK370
•F1030-GM, F1070-GM, F1070-GM-L
•F1000-AI-20, F1000-AI-30, F1000-AI-50
•F1000-930-AI, F1000-950-AI, F1000-960-AI,
F1000-970-AI, F1000-980-AI, F1000-990-AI
•F1000-E-VG, F1000-V70
•F100-E-G3
•F1000-AI-60
•F1000-C-G3 Slot 1
E8601P07 or higher
•F1090
•F1000-AI-70, F1000-AI-80, F1000-AI-90
•F1000-S-G3, F1000-A-G3, F1000-E-G3
•F1000-AK1414, F1000-AK1424, F1000-AK1434,
F1000-AK1514, F1000-AK1524, F1000-AK1534,
F1000-AK1614
Slots 1 to 4
NSQM1F1KGMC
Table 5 Compatible hardware and software for the NSQM1F1KGMC encryption module
Compatible firewalls
Compatible slots
Software version
•F1020
•F100-A-G2, F100-A-EI
•F1000-AK130
•F1020-GM
•F1000-920-AI
•F100-A-G3
•F100-A80-WiNet
Slot 1
R9345P14 or higher
•F1030, F1050, F1060, F1070, F1080
•F100-E-G2, F100-A-SI, F100-E-EI
•F1000-C-G2, F1000-C-EI, F1000-E-G2,
F1000-S-G2, F1000-A-G2
•F1000-AK135, F1000-AK140, F1000-AK145,
F1000-AK150, F1000-AK155, F1000-AK160,
F1000-AK165, F1000-AK170, F1000-AK175,
F1000-AK1212, F1000-AK1222, F1000-AK1232,
F1000-AK1312, F1000-AK1322, F1000-AK1332,
F1000-AK180, F1000-AK185,
F1000-GM-AK370, F1000-GM-AK370
•F1030-GM, F1070-GM, F1070-GM-L
•F1000-AI-20, F1000-AI-30, F1000-AI-50
•F1000-930-AI, F1000-950-AI, F1000-960-AI,
F1000-970-AI, F1000-980-AI, F1000-990-AI
•F1000-E-VG, F1000-V70
•F100-E-G3
Slots 1 to 2

6
Compatible firewalls
Compatible slots
Software version
•F1000-AI-60
•F1000-C-G3 Slot 1
E8601P07 or higher
•F1090
•F1000-AI-70, F1000-AI-80, F1000-AI-90
•F1000-S-G3, F1000-A-G3, F1000-E-G3
•F1000-AK1414, F1000-AK1424, F1000-AK1434,
F1000-AK1514, F1000-AK1524, F1000-AK1534,
F1000-AK1614
Slots 1 to 4
F1000-AI-25, F1000-AI-35, F1000-AI-55 Slots 1 and 2 E8860P04 or higher
F1000-AI-65, F1000-AI-75 Slots 1 and 2 E8860P04 or higher
F5000-AI-15 Slots 1 and 2 A8660P03 or higher
NSQM1F5KGM0
Table 6 Compatible hardware and software for the NSQM1F5KGM0 encryption module
Compatible firewalls
Compatible slots
Software version
•F5010, F5020, F5040
•F5000-S, F5000-C
•F5020-GM Slot 1 R9320 or higher
NSQM1F5KGMC
Table 7 Compatible hardware and software for the NSQM1F5KGMC encryption module
Compatible firewalls
Compatible slots
Software version
•F5010, F5020, F5040
•F5000-S, F5000-C
•F5020-GM Slot 1 E9342 or higher
NS-HTIM-GMG2A
Table 8 Compatible hardware and software for the NS-HTIM-GMG2A encryption module
Compatible firewalls
Compatible slots
Software version
•F5030, F5060, F5080, F5030-6GW
•F5000-M, F5000-A
•F5000-AI-20, F5000-AI-40
•F5000-V30
Slots 1 E9628 or higher

7
NS-HTIM-GMG2B
Table 9 Compatible hardware and software for the NS-HTIM-GMG2B encryption module
Compatible firewalls
Compatible slots
Software version
•F5030-D, F5060-D, F5080-D
•F5000-AK515, F5000-AK525 Slots 2/1 E9620 or higher
Installing the encryption modules
No encryption modules are provided with the device. Purchase them as needed.
Installing an NSQM1F1KGM0 encryption module
An NSQM1F1KGM0 encryption module is 1U high and occupies two interface module slots.
To install an NSQM1F1KGM0 encryption module:
1. Face the rear panel of the device and identify the target slots.
2. Use a Phillips screwdriver to loosen the captive screws on the filler panels and then remove the
filler panels from the slots.
Keep the removed filler panels secure.
Figure 8 Removing the filler panels
3. Open the ejector levers of the encryption module and then gently push the module into the slots
along the guide rails.
4. Close the ejector levers. Make sure the module is seated securely in the slots.
5. Use a Phillips screwdriver to fasten the captive screws on the module.
12

8
Figure 9 Installing an NSQM1F1KGM0 encryption module
Installing an NSQM1F1KGMB or
NSQM1F1KGMC encryption module
The installation procedure is similar for the NSQM1F1KGMB and NSQM1F1KGMC encryption
modules. The following procedure installs an NSQM1F1KGMB encryption module.
To install an NSQM1F1KGMB encryption module:
1. Face the rear panel of the device and identify the target slot.
2. Use a Phillips screwdriver to loosen the captive screws on the filler panel and then remove the
filler panel from the slot.
Keep the removed filler panel secure.
Figure 10 Removing the filler panel
3. Open the ejector levers of the encryption module and then gently push the module into the slot
along the guide rails.
4. Close the ejector levers. Make sure the module is seated securely in the slot.
5. Use a Phillips screwdriver to fasten the captive screws on the module.
2
2
1
3
3
12

9
Figure 11 Installing an NSQM1F1KGMB encryption module
Installing an NSQM1F5KGM0 or
NSQM1F5KGMC encryption module
The installation procedure is similar for the NSQM1F5KGM0 and NSQM1F5KGMC encryption
modules. The following procedure installs an NSQM1F5KGM0 encryption module.
To install an NSQM1F5KGM0 encryption module:
1. Face the rear panel of the device and identify the target slot.
2. Use a Phillips screwdriver to loosen the captive screws on the filler panel and then remove the
filler panel from the slot.
Keep the removed filler panel secure.
3. Open the ejector levers of the encryption module and then gently push the module into the slot
along the guide rails.
4. Close the ejector levers. Make sure the module is seated securely in the slot.
5. Use a Phillips screwdriver to fasten the captive screws on the module.
Figure 12 Installing an NSQM1F5KGM0 encryption module
2
2
1
3
3
2
2
1
3
3

10
Installing an NS-HTIM-GMG2A or
NS-HTIM-GMG2B encryption module
The NS-HTIM-GMG2A and NS-HTIM-GMG2B encryption modules are 1U high and each occupies
two interface module slots. They use the same installation procedure. The following procedure
installs an NS-HTIM-GMG2A encryption module.
To install an NS-HTIM-GMG2A encryption module:
1. Face the rear panel of the device and identify the target slots.
2. Use a Phillips screwdriver to loosen the captive screws on the filler panels and then remove the
filler panels from the slots.
Keep the removed filler panels secure.
Figure 13 Removing the filler panels
3. Open the ejector levers of the encryption module and then gently push the module into the slots
along the guide rails.
4. Close the ejector levers. Make sure the module is seated securely in the slots.
5. Use a Phillips screwdriver to fasten the captive screws on the module.
Figure 14 Installing an NS-HTIM-GMG2A encryption module
Functionalities
The encryption modules provide the following functionalities:
•
Generate 256-bit GM standard SM2 key pairs.
•
Use SM1 ECB and CBC modes to encrypt and decrypt data.
•
Use the SM2/RSAkey pairs stored internally or imported externally as needed to digitally sign
and verify the requested data.
1 2
3
3
45
5

11
•
Create a digital envelope based on the SM2/RSA encryption algorithm.
•
Generate random number sequences on the physical noise generator chip approved by the
China's State Cryptography Administration (SCA).
•
Provide user access control and management to improve device security.
•
Support key backup and recovery to ensure security and reliability of security application
systems.
Application scenarios
The encryption modules are used to provide secure encrypted transmission mainly in the power,
finance, transportation, and industrial control sectors.
They can be used on an IPsec VPN as shown in Figure 15 and other scenarios to encrypt and verify
data by using the GM encryption algorithms, enhancing transmission security and data integrity.
When using the encryption modules, make sure both the transmission ends use the same encryption
algorithm to encrypt data.
Figure 15 Application scenario