A Flow Specification protocol-based communication method, comprising: obtaining (S120, S220), by a controller, a requirement indicating that a first resource on a forwarding device needs to be associated with a second resource on the forwarding device, wherein the forwarding device is a provider edge PE device; sending (S130, S230), by the controller, a Border Gateway Protocol Flow Specification, BGP Flow Spec, protocol packet to the forwarding device according to the requirement, wherein the BGP Flow Spec protocol packet comprises a network layer reachability information, NLRI, field and an extended community attribute field, the NLRI field carries characteristic information of a first resource, the extended community attribute field carries a global identifier, GID and a flag information, wherein the GID has a mapping relationship to a second resource, and the flag information is used to instruct the forwarding device to associate the first resource with the second resource, and instruct the forwarding device to forward a data packet matching the characteristic information of the first resource via the second resource; wherein the first resource comprises the routing information of a second customer edge CE device, and the second resource is the VPN instance of a first customer edge CE device; wherein the VPN instance of the first CE device is established on the forwarding device and wherein the BGP Flow Spec protocol packet is used to instruct the forwarding device to add the routing information of the second CE device to the VPN routing table of the VPN instance of the first CE device; or wherein the first resource comprises a source IP address which is an IP address of a first CE device, and a destination IP address which is an IP address of a second CE device, and the second resource is the VPN instance of a third CE device; wherein a virtual private network VPN instance of the first customer edge CE device and the VPN instance of the third CE device are established on the forwarding device and the BGP Flow Spec protocol packet is used to instruct to forward, according to routing information that is of the second CE device and that is comprised in the VPN routing table of the VPN instance of the third CE device, a data packet whose source IP address and destination IP address are consistent with those of the first resource. obtaining (S120, S220), by a controller, a requirement indicating that a first resource on a forwarding device needs to be associated with a second resource on the forwarding device, wherein the forwarding device is a provider edge PE device; sending (S130, S230), by the controller, a Border Gateway Protocol Flow Specification, BGP Flow Spec, protocol packet to the forwarding device according to the requirement, wherein the BGP Flow Spec protocol packet comprises a network layer reachability information, NLRI, field and an extended community attribute field, the NLRI field carries characteristic information of a first resource, the extended community attribute field carries a global identifier, GID and a flag information, wherein the GID has a mapping relationship to a second resource, and the flag information is used to instruct the forwarding device to associate the first resource with the second resource, and instruct the forwarding device to forward a data packet matching the characteristic information of the first resource via the second resource; wherein the first resource comprises the routing information of a second customer edge CE device, and the second resource is the VPN instance of a first customer edge CE device; wherein the VPN instance of the first CE device is established on the forwarding device and wherein the BGP Flow Spec protocol packet is used to instruct the forwarding device to add the routing information of the second CE device to the VPN routing table of the VPN instance of the first CE device; or wherein the first resource comprises a source IP address which is an IP address of a first CE device, and a destination IP address which is an IP address of a second CE device, and the second resource is the VPN instance of a third CE device; wherein a virtual private network VPN instance of the first customer edge CE device and the VPN instance of the third CE device are established on the forwarding device and the BGP Flow Spec protocol packet is used to instruct to forward, according to routing information that is of the second CE device and that is comprised in the VPN routing table of the VPN instance of the third CE device, a data packet whose source IP address and destination IP address are consistent with those of the first resource.