A method for generating an access control list, ACL, table, executed in a data center, DC, network by a controller, a router or a switch, said method comprising the steps of: obtaining a port type of each port of a first network device (S11..S33) in the network; selecting, based on the port type of each port, a target port whose port type is a preset type from all ports of the first network device (S11..S33), the preset type comprises a default type and an interconnection type; generating a corresponding first-type ACL entry for each target port; generating one second-type ACL entry corresponding to a routing table of the first network device (S11.. S33), wherein an action of the second-type ACL entry is redirecting to the routing table; and adding the second-type ACL entry and each first-type ACL entry to an ACL table of the first network device (S11.. S33), characterized in that the first-type ACL entry is an ACL entry comprising the target port; and the generating a corresponding first-type access control list, ACL, entry for each target port comprises: determining a second network device (S11..S33) in a network architecture of the network in which the first network device (S11..S33) is located, wherein the second network device (S11..S33) is any of the network devices (S11..S33) in the network architecture different from the first network device (S11..S33); generating the routing table, wherein each entry of the routing table comprises a next hop from the first network device (S11..S33) to one second network device (S11..S33); and for each target port, determining, based on the routing table, an action of the target port corresponding to each second network device (S11..S33), and for each second network device (S11..S33), generating an ACL entry comprising the target port, the second network device (S11..S33), and the action of the target port corresponding to the second network device (S11..S33). obtaining a port type of each port of a first network device (S11..S33) in the network; selecting, based on the port type of each port, a target port whose port type is a preset type from all ports of the first network device (S11..S33), the preset type comprises a default type and an interconnection type; generating a corresponding first-type ACL entry for each target port; generating one second-type ACL entry corresponding to a routing table of the first network device (S11.. S33), wherein an action of the second-type ACL entry is redirecting to the routing table; and adding the second-type ACL entry and each first-type ACL entry to an ACL table of the first network device (S11.. S33), characterized in that the first-type ACL entry is an ACL entry comprising the target port; and the generating a corresponding first-type access control list, ACL, entry for each target port comprises: determining a second network device (S11..S33) in a network architecture of the network in which the first network device (S11..S33) is located, wherein the second network device (S11..S33) is any of the network devices (S11..S33) in the network architecture different from the first network device (S11..S33); generating the routing table, wherein each entry of the routing table comprises a next hop from the first network device (S11..S33) to one second network device (S11..S33); and for each target port, determining, based on the routing table, an action of the target port corresponding to each second network device (S11..S33), and for each second network device (S11..S33), generating an ACL entry comprising the target port, the second network device (S11..S33), and the action of the target port corresponding to the second network device (S11..S33). determining a second network device (S11..S33) in a network architecture of the network in which the first network device (S11..S33) is located, wherein the second network device (S11..S33) is any of the network devices (S11..S33) in the network architecture different from the first network device (S11..S33); generating the routing table, wherein each entry of the routing table comprises a next hop from the first network device (S11..S33) to one second network device (S11..S33); and for each target port, determining, based on the routing table, an action of the target port corresponding to each second network device (S11..S33), and for each second network device (S11..S33), generating an ACL entry comprising the target port, the second network device (S11..S33), and the action of the target port corresponding to the second network device (S11..S33).