Restoration is provided in a communication system having two or more VPN endpoints coupled together through a network comprising a number of nodes interconnected through edges. VPN endpoints coupled through the network are adapted to communicate through a single connection with multiple other VPN endpoints. The single connection may be a VPN hose connection. A restoration topology, comprising backup edges corresponding to primary edges in the network, is determined for the network. A given primary edge is replaced with one or more backup edges if the given primary edge fails. A graph may represent the network and a tree may represent the connections in the network for VPNs connecting the VPN endpoints. The graph can be reduced to a second graph by determining shortest paths between each node in the tree and creating the backup edges from the shortest paths. The second graph can be reduced to a third graph by adding additional backup edges from tree nodes having non-tree edges to least common ancestor nodes. The third graph can be used to create a two-edge connected tree.