Protection switching of a virtual private network is provided whereby working VPN paths and protection VPN paths are defined. The working VPN path is monitored for increased data traffic and failures, and in response, data is switched from the working VPN path to the protection VPN path. The working VPN path is monitored for a return to proper functioning and normal data conditions, and data is then switched back from the protection VPN path to the working VPN path. Additionally, data capacity is managed through virtual bandwidth classes, and different classes of qualities of service are provided.