A method for controlling a service data flow and a network device are provided. The method includes receiving, by a network device, a service data flow, and acquiring a control label that is carried, based on the Label Control Protocol, in the service data flow, and performing, by the network device, network access control on the service data flow according to the control label by using admission control configuration information and application control configuration information that are delivered by a controller and are based on security group information, where the network access control includes at least one of admission control and application control. According to the embodiments of the present disclosure, admission control and/or application control may be performed on the service data flow, so as to effectively improve efficiency of processing the service data flow by the network device.