A protection switching method, applied to a first network device in a media access control, MAC, switched domain, wherein the first network device is connected to a customer edge, CE, device, the MAC switched domain further comprises two second network devices, the two second network devices are connected to two third network devices in an Internet protocol, IP, routing domain in a one-to-one correspondence, and the method comprises: receiving an address resolution protocol, ARP, message from the CE device, wherein the ARP message comprises a virtual local area network, VLAN, identifier and an IP address of the CE device; determining a data transmission path group associated with target traffic, wherein the target traffic is determined based on the VLAN identifier, and the data transmission path group comprises data transmission paths between the two second network devices and the first network device; when the first network device does not receive a first bidirectional forwarding detection, BFD, control message from a target network device within a preset quantity of consecutive time intervals, determining a first data transmission path that is in the data transmission path group and that is used to transmit the first BFD control message, wherein the target network device is one of the two third network devices, the first BFD control message is used to indicate that a first BFD session is in a connection establishment state, and session addresses of the first BFD session comprise the IP address of the CE device and an IP address of the target network device; and receiving and/or transmitting, through a second data transmission path other than the first data transmission path in the data transmission path group, a traffic flow that belongs to the target traffic; wherein before when the first network device does not receive a first BFD control message from a target network device within a preset quantity of consecutive time intervals, determining a first data transmission path that is in the data transmission path group and that is used to transmit the first BFD control message, the method further comprises: receiving a second BFD control message from the target network device, wherein a destination IP address of the second BFD control message is the IP address of the CE device, and a source IP address of the second BFD control message is the IP address of the target network device; and responding to the second BFD control message to establish the first BFD session; and transmitting a third BFD control message to the target network device, wherein the third BFD control message is used to indicate that the first BFD session is in the connection establishment state. receiving an address resolution protocol, ARP, message from the CE device, wherein the ARP message comprises a virtual local area network, VLAN, identifier and an IP address of the CE device; determining a data transmission path group associated with target traffic, wherein the target traffic is determined based on the VLAN identifier, and the data transmission path group comprises data transmission paths between the two second network devices and the first network device; when the first network device does not receive a first bidirectional forwarding detection, BFD, control message from a target network device within a preset quantity of consecutive time intervals, determining a first data transmission path that is in the data transmission path group and that is used to transmit the first BFD control message, wherein the target network device is one of the two third network devices, the first BFD control message is used to indicate that a first BFD session is in a connection establishment state, and session addresses of the first BFD session comprise the IP address of the CE device and an IP address of the target network device; and receiving and/or transmitting, through a second data transmission path other than the first data transmission path in the data transmission path group, a traffic flow that belongs to the target traffic; wherein before when the first network device does not receive a first BFD control message from a target network device within a preset quantity of consecutive time intervals, determining a first data transmission path that is in the data transmission path group and that is used to transmit the first BFD control message, the method further comprises: receiving a second BFD control message from the target network device, wherein a destination IP address of the second BFD control message is the IP address of the CE device, and a source IP address of the second BFD control message is the IP address of the target network device; and responding to the second BFD control message to establish the first BFD session; and transmitting a third BFD control message to the target network device, wherein the third BFD control message is used to indicate that the first BFD session is in the connection establishment state. receiving a second BFD control message from the target network device, wherein a destination IP address of the second BFD control message is the IP address of the CE device, and a source IP address of the second BFD control message is the IP address of the target network device; and responding to the second BFD control message to establish the first BFD session; and transmitting a third BFD control message to the target network device, wherein the third BFD control message is used to indicate that the first BFD session is in the connection establishment state.