1. A network access system comprising: at least one programmable access device, including first and second network interfaces through which packets are communicated with a first network and a second network respectively, wherein the at least one programmable access device comprises a forwarding table for routing packets between the first and second network interfaces, and a packet header filter for identifying messages received at one of the network interfaces on which policy-based services are to be implemented and for generating the identified messages via a message interface; an external processor, separate and distinct from the at least one programmable access device, and configured to implement policy-based services by receiving and processing the identified messages from the message interface, wherein the external processor comprises one or more service controllers for controlling functions for a respective type of service, at least one programmable access device controller for configuring the forwarding table, the packet header filter, and at least one other function of an associated programmable access device, and a message processor for the associated programmable access device for communicating messages to/from the message interface of the associated programmable access device; and an access router separate and distinct from both the external processor and the at least one programmable access device, wherein the access router is configured to route packets from the first network interface to the second network interface based on the forwarding table in the at least one programmable access device.