A method is provided to establish a path in an optical domain to couple first and second IP routing domains for use by a VPN. A network controller (NC) receives an optical path setup command and, in response, determines an optical path ID identifying an optical path. The NC sends a mapping command to a domain controller (DC) associated with the first IP routing domain and receives routing information that includes a VPN label. The NC sends a forwarding command including the routing information to a DC associated with the second IP routing domain, the forwarding command configured to cause a termination point in the second IP routing domain to forward a packet to the optical path when the packet comprises elements of the routing information.