A method and device for forwarding a packet are disclosed. When a first access device connected with a database server is to be configured with a mirror image rule, an SDN controller can transmit a mirror image rule adding message carrying the mirror image rule to the first access device. Where, the mirror image rule comprises an IP address of the database server, a MAC address of a database audit device connected with a second access device and a VXLAN tunnel between the first access device and the second access device. When receiving a database access packet whose destination IP address is an IP address of the database server, the first access device may replace a destination MAC address of a mirror packet for the database access packet with a MAC address of the database audit device according to the mirror image rule and forward the encapsulated VXLAN packet.