A method for generating forwarding entries for devices in an optical network, wherein the optical network comprises a virtual access node, AN, wherein the virtual AN comprises a first access device, a second access device, and an access port management apparatus, and the method comprises the steps of: acquiring, by the access port management apparatus, a virtual AN forwarding entry sent by an access management device, wherein the virtual AN forwarding entry comprises an ingress port, identifiers of services that need to be processed by the virtual AN, and an egress port; generating, by the access port management apparatus, a first forwarding entry for a first device in the first access device and the second access device according to the virtual AN forwarding entry, wherein the first forwarding entry comprises an ingress port, an egress port, and an identifier of a service that needs to be processed by the first device, wherein the identifier of a service that needs to be processed by the first device is used to indicate that the first device needs to encapsulate a first data flow, which is received from the ingress port in the first forwarding entry, into the service corresponding to the identifier of the service that needs to be processed by the first device; and generating, by the access port management apparatus, a second forwarding entry for a second device in the first access device and the second access device according to the virtual AN forwarding entry, wherein the second forwarding entry comprises an ingress port and an egress port; and wherein the first access device is an optical line terminal, OLT, and the second access device is a first optical network unit, ONU, a first optical network terminal, ONT, a first multi-dwelling unit, MDU, or a first digital subscriber line access multiplexer, DSLAM; or the first access device is a first digital subscriber line access multiplexer, DSLAM, and the second access device is a second DSLAM; or the first access device is a digital subscriber line access multiplexer, DSLAM, management device, and the second access device is a DSLAM. acquiring, by the access port management apparatus, a virtual AN forwarding entry sent by an access management device, wherein the virtual AN forwarding entry comprises an ingress port, identifiers of services that need to be processed by the virtual AN, and an egress port; generating, by the access port management apparatus, a first forwarding entry for a first device in the first access device and the second access device according to the virtual AN forwarding entry, wherein the first forwarding entry comprises an ingress port, an egress port, and an identifier of a service that needs to be processed by the first device, wherein the identifier of a service that needs to be processed by the first device is used to indicate that the first device needs to encapsulate a first data flow, which is received from the ingress port in the first forwarding entry, into the service corresponding to the identifier of the service that needs to be processed by the first device; and generating, by the access port management apparatus, a second forwarding entry for a second device in the first access device and the second access device according to the virtual AN forwarding entry, wherein the second forwarding entry comprises an ingress port and an egress port; and wherein the first access device is an optical line terminal, OLT, and the second access device is a first optical network unit, ONU, a first optical network terminal, ONT, a first multi-dwelling unit, MDU, or a first digital subscriber line access multiplexer, DSLAM; or the first access device is a first digital subscriber line access multiplexer, DSLAM, and the second access device is a second DSLAM; or the first access device is a digital subscriber line access multiplexer, DSLAM, management device, and the second access device is a DSLAM.