A method for protecting a tunnel, comprising: nesting a second protection group, further referred as IPG2, in a first protection group, wherein nesting the second protection group in the first protection group comprises: setting the second protection group on two intermediate nodes of the first protection group, wherein a Segment Edge Bridge, SEB, of the first protection group is different from that of the second protection group; and when a segment (B-C) between the two intermediate nodes fails, adopting the second protection group to protect the tunnel, wherein the step of adopting the second protection group to protect the tunnel further comprises: configuring an Ethernet Switch Path, ESP, for forwarding a Connectivity check Message, CCM, which is dedicated to an inter-segment failure diagnosis on a working segment or a protection segment, and through which a member segment of the first protection group performs a failure detection, wherein the second protection group is located in the member segment of the first protection group, and wherein the member segment refers to a working segment or a proctection segment of the first protection group (IPG 1), and adding, on an end point of the IPG2 that the CCM enters, forwarded information of a layer-2 header corresponding to the CCM which enters the IPG2, to a protection list associated with the end point, wherein the layer-2 header is a 3-tuple of <ESP-DA, ESP-SA, ESP-VID>; the forwarded information consists of a 2-tuple of <ESP-DA, ESP-VID>; and the protection list is a 2-tuple list associated with the end point of the IPG2; wherein the EPS-DA is a destination Media Access Control, MAC, address of the ESP and wherein the ESP-SA is a source MAC address of ESP and wherein the ESP-VID is a Virtual Local Area Netwrok Identification, VLAN ID, to which the member segment of the first protection group belongs. nesting a second protection group, further referred as IPG2, in a first protection group, wherein nesting the second protection group in the first protection group comprises: setting the second protection group on two intermediate nodes of the first protection group, wherein a Segment Edge Bridge, SEB, of the first protection group is different from that of the second protection group; and when a segment (B-C) between the two intermediate nodes fails, adopting the second protection group to protect the tunnel, wherein the step of adopting the second protection group to protect the tunnel further comprises: configuring an Ethernet Switch Path, ESP, for forwarding a Connectivity check Message, CCM, which is dedicated to an inter-segment failure diagnosis on a working segment or a protection segment, and through which a member segment of the first protection group performs a failure detection, wherein the second protection group is located in the member segment of the first protection group, and wherein the member segment refers to a working segment or a proctection segment of the first protection group (IPG 1), and adding, on an end point of the IPG2 that the CCM enters, forwarded information of a layer-2 header corresponding to the CCM which enters the IPG2, to a protection list associated with the end point, wherein the layer-2 header is a 3-tuple of <ESP-DA, ESP-SA, ESP-VID>; the forwarded information consists of a 2-tuple of <ESP-DA, ESP-VID>; and the protection list is a 2-tuple list associated with the end point of the IPG2; wherein the EPS-DA is a destination Media Access Control, MAC, address of the ESP and wherein the ESP-SA is a source MAC address of ESP and wherein the ESP-VID is a Virtual Local Area Netwrok Identification, VLAN ID, to which the member segment of the first protection group belongs. configuring an Ethernet Switch Path, ESP, for forwarding a Connectivity check Message, CCM, which is dedicated to an inter-segment failure diagnosis on a working segment or a protection segment, and through which a member segment of the first protection group performs a failure detection, wherein the second protection group is located in the member segment of the first protection group, and wherein the member segment refers to a working segment or a proctection segment of the first protection group (IPG 1), and adding, on an end point of the IPG2 that the CCM enters, forwarded information of a layer-2 header corresponding to the CCM which enters the IPG2, to a protection list associated with the end point, wherein the layer-2 header is a 3-tuple of <ESP-DA, ESP-SA, ESP-VID>; the forwarded information consists of a 2-tuple of <ESP-DA, ESP-VID>; and the protection list is a 2-tuple list associated with the end point of the IPG2; wherein the EPS-DA is a destination Media Access Control, MAC, address of the ESP and wherein the ESP-SA is a source MAC address of ESP and wherein the ESP-VID is a Virtual Local Area Netwrok Identification, VLAN ID, to which the member segment of the first protection group belongs.