Sometimes you want to see how the tunnel and the transport modes works with encapsulation, especially when using GRE over IPSEC and you would like to decrypt the ESP or IPSEC packet to see how GRE packet is encapulated with the two modes, especially for studying , teaching or may be for troubleshooting.
Below how to do it:
Configue the ESP encryption with null in the transform set.
crypto ipsec transform-set TS esp-null esp-sha512-hmac
Copy the pre-shared key configured in phase 1 ISAKMP.
crypto isakmp key cisco address 18.104.22.168
Open wireshark. right-click on the ESP packet, in this scenario the ESP SA from the source 22.214.171.124 to the destination 126.96.36.199. Under the Protocol Preferences, check the three options shown below.
Enter the informations related to the ESP SA.
Src IP: 188.8.131.52
Dest IP: 184.108.40.206
Authentication: SHA512-hmac-512-256 [RFC4868]
Authentication Key: cisco