A method for performing detection on an access control list, ACL, rule, wherein the method comprises: obtaining, by a first network entity, a second access control list, ACL, rule, wherein the first network entity comprises multiple first entries, each first entry comprises a corresponding first rule index and corresponding first information, the first rule index is used to indicate a corresponding first ACL rule, the first information is information extracted by the first network entity from the corresponding first ACL rule, and the first ACL rule is a valid ACL rule; generating, by the first network entity, a second entry according to the second ACL rule, wherein the second entry comprises a second rule index and second information, the second rule index is used to indicate the second ACL rule, the second information is information extracted by the first network entity from the second ACL rule, and the second information has a same attribute as that of the first information; successively selecting individual first entries and determining, by the first network entity, whether the second information is a subset of the corresponding first information, wherein the second information is a subset of the first information only when each item in the second information is a subset of a corresponding item in the first information; and if the first network entity determines that for a selected first entry, the second information is a subset of the corresponding first information, determining, by the first network entity, that the second ACL rule is an invalid ACL rule, and skipping, by the first network entity, sending the second ACL rule to a second network entity. obtaining, by a first network entity, a second access control list, ACL, rule, wherein the first network entity comprises multiple first entries, each first entry comprises a corresponding first rule index and corresponding first information, the first rule index is used to indicate a corresponding first ACL rule, the first information is information extracted by the first network entity from the corresponding first ACL rule, and the first ACL rule is a valid ACL rule; generating, by the first network entity, a second entry according to the second ACL rule, wherein the second entry comprises a second rule index and second information, the second rule index is used to indicate the second ACL rule, the second information is information extracted by the first network entity from the second ACL rule, and the second information has a same attribute as that of the first information; successively selecting individual first entries and determining, by the first network entity, whether the second information is a subset of the corresponding first information, wherein the second information is a subset of the first information only when each item in the second information is a subset of a corresponding item in the first information; and if the first network entity determines that for a selected first entry, the second information is a subset of the corresponding first information, determining, by the first network entity, that the second ACL rule is an invalid ACL rule, and skipping, by the first network entity, sending the second ACL rule to a second network entity.