A method of separating carrier-grade network address translation, CGN, forwarding and control, comprising: assigning, by a Broadband Remote Access Server, BRAS, control plane, CP, device, a private network address to a target user terminal accessing a BRAS data plane, DP, device when detecting that the target user terminal is successfully authenticated; selecting, by the BRAS CP device, a target CGN card from one or more CGN cards in the BRAS DP device, wherein selecting the target CGN card comprises: when there are a plurality of CGN cards in the BRAS DP device, selecting, by the BRAS CP device, the target CGN card from the CGN cards in the BRAS DP device, and after selecting the target CGN card from the CGN cards in the BRAS DP device, further recording, by the BRAS CP device, a corresponding relationship between a target interface and the selected CGN card, wherein the target user terminal accesses the BRAS DP device via the target interface on the BRAS DP device, and wherein when detecting that another target user terminal accessing the BRAS DP device via the target interface is successfully authenticated, selecting the target CGN card for said another target user terminal based on the recorded corresponding relationship; selecting, by the BRAS CP device, a target public network address and a target port block from idle public network addresses and port blocks on the target CGN card; sending, by the BRAS CP device, CGN configuration information for the target user terminal to the BRAS DP device, wherein the CGN configuration information comprises identity information of the target CGN card, the private network address, the target public network address and the target port block. assigning, by a Broadband Remote Access Server, BRAS, control plane, CP, device, a private network address to a target user terminal accessing a BRAS data plane, DP, device when detecting that the target user terminal is successfully authenticated; selecting, by the BRAS CP device, a target CGN card from one or more CGN cards in the BRAS DP device, wherein selecting the target CGN card comprises: when there are a plurality of CGN cards in the BRAS DP device, selecting, by the BRAS CP device, the target CGN card from the CGN cards in the BRAS DP device, and after selecting the target CGN card from the CGN cards in the BRAS DP device, further recording, by the BRAS CP device, a corresponding relationship between a target interface and the selected CGN card, wherein the target user terminal accesses the BRAS DP device via the target interface on the BRAS DP device, and wherein when detecting that another target user terminal accessing the BRAS DP device via the target interface is successfully authenticated, selecting the target CGN card for said another target user terminal based on the recorded corresponding relationship; when there are a plurality of CGN cards in the BRAS DP device, selecting, by the BRAS CP device, the target CGN card from the CGN cards in the BRAS DP device, and after selecting the target CGN card from the CGN cards in the BRAS DP device, further recording, by the BRAS CP device, a corresponding relationship between a target interface and the selected CGN card, wherein the target user terminal accesses the BRAS DP device via the target interface on the BRAS DP device, and wherein when detecting that another target user terminal accessing the BRAS DP device via the target interface is successfully authenticated, selecting the target CGN card for said another target user terminal based on the recorded corresponding relationship; selecting, by the BRAS CP device, a target public network address and a target port block from idle public network addresses and port blocks on the target CGN card; sending, by the BRAS CP device, CGN configuration information for the target user terminal to the BRAS DP device, wherein the CGN configuration information comprises identity information of the target CGN card, the private network address, the target public network address and the target port block.