A traffic control method including obtaining, by a network device, a configuration policy from a management device, where the configuration policy is used to control access between a plurality of branch devices, and where each of the plurality of branch devices is connected to the network device, and configuring, by the network device, a destination of traffic between the branch devices based on the configuration policy, so that the traffic between the branch devices is transmitted to the configured destination.