The invention refers to net access control method based on virtual LAN. The method is: configures the access authority of ports on LAN user access appliances, when a user access in LAN, user access appliance examines the authority state of application port; carries on the user LAN access control according to the authority state. The device includes: user access appliance, access control applianceand access identification server, the user accesses the net through user access appliance, and carries net access authentication through access control appliance and access authentication server.