Embodiments of the present invention disclose a virtual network protection method, including: receiving, by a network device (for example, a transport-controller), a virtual network topology establishment request message, where the virtual network topology establishment request message carries a virtual network resource parameter and/or a virtual network protection and recovery type; reserving a working physical resource and a protection physical resource in an idle physical resource of a physical network according to the virtual network resource parameter and/or the virtual network protection and recovery type; and mapping a virtual link on a virtual network to the working physical resource and the protection physical resource. The foregoing solution enables a virtual network to have a protection capability. When a fault occurs on the physical network corresponding to the virtual network, the physical network rapidly completes protection switching. The protection switching does not affect the virtual network, and a virtual network topology is not changed, thereby improving user experience.