A first network device includes a processor configured to analyze a data stream entering a network on which the first network device is located to obtain a traffic characteristic of a target data stream, and advertise a Flow Specification (FlowSpec) route, where the FlowSpec route carries redirect indication information, the redirect indication information includes identification information, the identification information is used to uniquely identify a first virtual private network (VPN) instance in a second network device, the redirect indication information instructing to redirect the data stream including the traffic characteristic of the target data stream to the first VPN instance, the second network device is an edge device of a service provider network accessed by the network, and the first VPN instance is a target VPN instance to which the target data stream is redirected in the second network device.