diff --git a/en_US.ISO8859-1/books/handbook/security/chapter.sgml b/en_US.ISO8859-1/books/handbook/security/chapter.sgml
index afb1f9cd3c..7fb7cd0248 100644
--- a/en_US.ISO8859-1/books/handbook/security/chapter.sgml
+++ b/en_US.ISO8859-1/books/handbook/security/chapter.sgml
@@ -4808,7 +4808,7 @@ ipfw add 1 allow udp from W.X.Y.Z to A.B.C.D isakmp
        <para><quote>If a packet arrives from <hostid
          role="ipaddr">W.X.Y.Z</hostid>, and that packet is encapsulating
          another packet, and it is destined for <hostid
-         role="ipaddr">A.B.C.D</hostid>, then encrypt it, using the
+         role="ipaddr">A.B.C.D</hostid>, then decrypt it, using the
          necessary security associations.</quote></para>
  
        <para>A subtle change, but a necessary one.</para>