A method for session protection, said method comprising the steps of: determining (S301, S401), by a first device, that a failure occurs in a session between the first device and a second device; and sending (S303, S403), by the first device, to the second device after the failure occurs, a first session establishment packet used to establish a new session, wherein the first session establishment packet carries capability information of the first device, and the capability information of the first device indicates that the first device does not have a capability of filtering a protocol packet for the new session; wherein the method further comprises the steps of: receiving, by the first device, after the failure occurs, a second session establishment packet that is sent by the second device and that is used to establish the new session, wherein the second session establishment packet carries capability information of the second device, and the capability information of the second device indicates that the second device does not have the capability of filtering the protocol packet for the new session; and establishing, by the first device, the new session based on the first session establishment packet and the second session establishment packet, wherein the new session does not have the capability of filtering the protocol packet. determining (S301, S401), by a first device, that a failure occurs in a session between the first device and a second device; and sending (S303, S403), by the first device, to the second device after the failure occurs, a first session establishment packet used to establish a new session, wherein the first session establishment packet carries capability information of the first device, and the capability information of the first device indicates that the first device does not have a capability of filtering a protocol packet for the new session; wherein the method further comprises the steps of: receiving, by the first device, after the failure occurs, a second session establishment packet that is sent by the second device and that is used to establish the new session, wherein the second session establishment packet carries capability information of the second device, and the capability information of the second device indicates that the second device does not have the capability of filtering the protocol packet for the new session; and establishing, by the first device, the new session based on the first session establishment packet and the second session establishment packet, wherein the new session does not have the capability of filtering the protocol packet. receiving, by the first device, after the failure occurs, a second session establishment packet that is sent by the second device and that is used to establish the new session, wherein the second session establishment packet carries capability information of the second device, and the capability information of the second device indicates that the second device does not have the capability of filtering the protocol packet for the new session; and establishing, by the first device, the new session based on the first session establishment packet and the second session establishment packet, wherein the new session does not have the capability of filtering the protocol packet.