A method of controlling network access in a Virtual Extensible Local Area Network, VxLAN, wherein the method comprises: when a terminal comes online for a first time, obtaining, by a Network Attached Server, a temporary role for a terminal, when receiving a first Internet Protocol address request from the terminal, requesting, by the NAS, a temporary IP address for the terminal, controlling, by the NAS, the terminal to perform a portal authentication based on the temporary IP address, wherein the temporary IP address belongs to an IP network segment corresponding to the temporary role, and a lease for the temporary IP address is a set minimum lease; forcing, by the NAS, the terminal to go offline based on an obtained offline notification when the portal authentication is successful; when the terminal comes online for a second time, obtaining, by the NAS, a service role for the terminal from a Remote Authentication Dial In User Service, RADIUS, Server, which is determined by the RADIUS Server based on account information of the terminal in registration information, wherein the registration information records a Media Access Control, MAC, address of the terminal and corresponding account information of the terminal, and the service role is a service Virtual Local Area Network, VLAN, or a service VxLAN to which the terminal belongs. when receiving a second IP address request sent by the terminal at expiry of the lease for the temporary IP address, requesting, by the NAS, a first service IP address for the terminal, controlling, by the NAS, the terminal to perform the network access based on the first service IP address, wherein the first service IP address belongs to an IP network segment corresponding to the service role. when a terminal comes online for a first time, obtaining, by a Network Attached Server, a temporary role for a terminal, when receiving a first Internet Protocol address request from the terminal, requesting, by the NAS, a temporary IP address for the terminal, controlling, by the NAS, the terminal to perform a portal authentication based on the temporary IP address, wherein the temporary IP address belongs to an IP network segment corresponding to the temporary role, and a lease for the temporary IP address is a set minimum lease; when receiving a first Internet Protocol address request from the terminal, requesting, by the NAS, a temporary IP address for the terminal, controlling, by the NAS, the terminal to perform a portal authentication based on the temporary IP address, requesting, by the NAS, a temporary IP address for the terminal, controlling, by the NAS, the terminal to perform a portal authentication based on the temporary IP address, wherein the temporary IP address belongs to an IP network segment corresponding to the temporary role, and a lease for the temporary IP address is a set minimum lease; forcing, by the NAS, the terminal to go offline based on an obtained offline notification when the portal authentication is successful; when the terminal comes online for a second time, obtaining, by the NAS, a service role for the terminal from a Remote Authentication Dial In User Service, RADIUS, Server, which is determined by the RADIUS Server based on account information of the terminal in registration information, wherein the registration information records a Media Access Control, MAC, address of the terminal and corresponding account information of the terminal, and the service role is a service Virtual Local Area Network, VLAN, or a service VxLAN to which the terminal belongs. when receiving a second IP address request sent by the terminal at expiry of the lease for the temporary IP address, requesting, by the NAS, a first service IP address for the terminal, controlling, by the NAS, the terminal to perform the network access based on the first service IP address, requesting, by the NAS, a first service IP address for the terminal, controlling, by the NAS, the terminal to perform the network access based on the first service IP address, wherein the first service IP address belongs to an IP network segment corresponding to the service role.