Embodiments of the present disclosure provide a failure protection method based on a ring protection link, a device, and a system, and nodes in the ring protection link include a forwarding device in an SDN. The method includes: receiving, by a network controller, a high-priority failure message sent by a first node, where the failure message includes information used to indicate a failure; obtaining, according to the failure message, data information about port state changes that are of the nodes and that are caused by the failure; and sending a high-priority switching message to each of the nodes, so that each of the nodes updates a local MAC address table according to the switching message, where the switching message includes the data information about port state changes that are of the nodes and that are caused by the failure.