The present disclosure provides a method, an apparatus, and a system for collecting an access control list. A second network device receives a first LSA packet flooded by a first network device, where the first LSA packet includes a first network device identifier and first ACL information, and the first network device and the second network device belong to a same IGP area; and sends an extended first BGP-LS packet to a controller, where the extended first BGP-LS packet includes the first network device identifier and the first ACL information, so that the controller can collect ACL information of the first network device and manage the ACL information of the first network device.