A terminal authentication apparatus and method. The method includes sending, by an authenticator, a media access control (MAC) address of a terminal to an authentication server, and authenticating, by the authentication server, the MAC address according to a preset MAC address list. When an authentication result indicates that the terminal does not belong to the preset MAC address list, the method includes detecting, by a security gateway according to a data stream of the terminal, whether the terminal is a trusted terminal. The method also includes instructing, according to a detection result, the authentication server to update the MAC address list; and after the MAC address list is updated, triggering the authenticator to re-authenticate the terminal. The present disclosure resolves a problem that normal monitoring is seriously affected due to the fact that a terminal that is not in a whitelist is directly not allowed to access a monitoring network.