A method for obtaining an identifier of a terminal device, the method comprising: receiving, by a gateway node, a first message from a terminal device, and sending a second message to a control plane node, wherein both the first message and the second message carry a temporary identifier of the terminal device; receiving, by the gateway node, a third message from the control plane node, wherein the third message is sent by the control plane node when the control plane node cannot obtain a permanent identifier of the terminal device; sending, by the gateway node, a fourth message to the terminal device based on the third message, wherein the fourth message is used to respond to the first message; receiving, by the gateway node, a fifth message from the terminal device, wherein the fifth message carries the permanent identifier of the terminal device; and sending, by the gateway node, the permanent identifier of the terminal device to the control plane node based on the fifth message wherein the sending, by the gateway node, a fourth message to the terminal device based on the third message comprises: sending, by the gateway node, the fourth message to the terminal device by using a first internet protocol security, IPsec, connection between the gateway node and the terminal device, wherein the fourth message carries a first failure cause value, wherein the first failure cause value is used to notify the terminal device that the first IPsec connection fails, the first failure cause value is further used to instruct the terminal device to send an association parameter to the gateway node to associate the first IPsec connection with a second IPsec connection, the association parameter is a parameter used to associate the first IPsec connection with the second IPsec connection, and the second IPsec connection is an IPsec connection established after the first IPsec connection is disconnected. receiving, by a gateway node, a first message from a terminal device, and sending a second message to a control plane node, wherein both the first message and the second message carry a temporary identifier of the terminal device; receiving, by the gateway node, a third message from the control plane node, wherein the third message is sent by the control plane node when the control plane node cannot obtain a permanent identifier of the terminal device; sending, by the gateway node, a fourth message to the terminal device based on the third message, wherein the fourth message is used to respond to the first message; receiving, by the gateway node, a fifth message from the terminal device, wherein the fifth message carries the permanent identifier of the terminal device; and sending, by the gateway node, the permanent identifier of the terminal device to the control plane node based on the fifth message wherein the sending, by the gateway node, a fourth message to the terminal device based on the third message comprises: sending, by the gateway node, the fourth message to the terminal device by using a first internet protocol security, IPsec, connection between the gateway node and the terminal device, wherein the fourth message carries a first failure cause value, wherein the first failure cause value is used to notify the terminal device that the first IPsec connection fails, the first failure cause value is further used to instruct the terminal device to send an association parameter to the gateway node to associate the first IPsec connection with a second IPsec connection, the association parameter is a parameter used to associate the first IPsec connection with the second IPsec connection, and the second IPsec connection is an IPsec connection established after the first IPsec connection is disconnected. sending, by the gateway node, the fourth message to the terminal device by using a first internet protocol security, IPsec, connection between the gateway node and the terminal device, wherein the fourth message carries a first failure cause value, wherein the first failure cause value is used to notify the terminal device that the first IPsec connection fails, the first failure cause value is further used to instruct the terminal device to send an association parameter to the gateway node to associate the first IPsec connection with a second IPsec connection, the association parameter is a parameter used to associate the first IPsec connection with the second IPsec connection, and the second IPsec connection is an IPsec connection established after the first IPsec connection is disconnected.