A method for controlling network access, comprising: configuring, by an aggregation switch in a plurality of aggregation switches (102a-c, 202a-c), an Access Control List, ACL, rule on the aggregation switch, wherein the ACL rule comprises a first network segment and a second network segment, and the first network segment and the second network segment correspond to a same user group or different user groups, or the first network segment corresponds to a user group and the second network segment corresponds to a resource group, and wherein the ACL rule is a same ACL rule which resides in each aggregation switch within the plurality of aggregation switches; receiving, by the aggregation switch, a user packet from a user terminal sent via an access switch (101 a-e, 201 a-e), whereby a port isolating function is enabled on the access switch, so that a packet received by the access switch via a user port can only be forwarded to the aggregation switch via an upstream port of the access switch; comparing, by the aggregation switch, a source Internet Protocol, IP, address of the user packet with the first network segment in the ACL rule and a destination IP address of the user packet with the second network segment in the ACL rule, wherein the source IP address of the user packet is an IP address in a network segment corresponding to a Virtual Local Area Network, VLAN, associated with a user group to which the user terminal belongs; and discarding, by the aggregation switch, the user packet when the source IP address of the user packet matches with the first network segment and the destination IP address of the user packet matches with the second network segment. configuring, by an aggregation switch in a plurality of aggregation switches (102a-c, 202a-c), an Access Control List, ACL, rule on the aggregation switch, wherein the ACL rule comprises a first network segment and a second network segment, and the first network segment and the second network segment correspond to a same user group or different user groups, or the first network segment corresponds to a user group and the second network segment corresponds to a resource group, and wherein the ACL rule is a same ACL rule which resides in each aggregation switch within the plurality of aggregation switches; receiving, by the aggregation switch, a user packet from a user terminal sent via an access switch (101 a-e, 201 a-e), whereby a port isolating function is enabled on the access switch, so that a packet received by the access switch via a user port can only be forwarded to the aggregation switch via an upstream port of the access switch; comparing, by the aggregation switch, a source Internet Protocol, IP, address of the user packet with the first network segment in the ACL rule and a destination IP address of the user packet with the second network segment in the ACL rule, wherein the source IP address of the user packet is an IP address in a network segment corresponding to a Virtual Local Area Network, VLAN, associated with a user group to which the user terminal belongs; and discarding, by the aggregation switch, the user packet when the source IP address of the user packet matches with the first network segment and the destination IP address of the user packet matches with the second network segment. <EOS>