A failure protection method based on a ring protection link, wherein nodes in the ring protection link comprise a forwarding device in a software-defined network, SDN, and the method comprises: receiving, by a network controller, a failure message sent by a first node, wherein a priority of the failure message is higher than that of another packet received by the network controller, the failure message comprises information used to indicate a failure, and the first node is any one of nodes in the ring protection link; obtaining, by the network controller, according to the failure message, data information about port state changes that are of the nodes and that are caused by the failure; and sending, by the network controller, a high-priority switching message to each of the nodes in the ring protection link, so that each of the nodes updates a local media access control MAC address table according to the switching message, to complete failure protection based on the ring protection link, wherein the switching message comprises the data information about port state changes that are of the nodes and that are caused by the failure; characterized in that the ring protection link further comprises a non-SDN device interconnected with the SDN, and the method further comprises: after detecting the failure, updating, by the first node the local MAC address table that has been stored in the first node; and sending, by the first node, a signal fail, SF, packet to a neighbor node, wherein the SF packet is transferred by using the neighbor node of the first node successively until all the nodes in the ring protection link complete protection against the failure, and the neighbor node comprises the non-SDN device and/or a SDN device. receiving, by a network controller, a failure message sent by a first node, wherein a priority of the failure message is higher than that of another packet received by the network controller, the failure message comprises information used to indicate a failure, and the first node is any one of nodes in the ring protection link; obtaining, by the network controller, according to the failure message, data information about port state changes that are of the nodes and that are caused by the failure; and sending, by the network controller, a high-priority switching message to each of the nodes in the ring protection link, so that each of the nodes updates a local media access control MAC address table according to the switching message, to complete failure protection based on the ring protection link, wherein the switching message comprises the data information about port state changes that are of the nodes and that are caused by the failure; characterized in that the ring protection link further comprises a non-SDN device interconnected with the SDN, and the method further comprises: after detecting the failure, updating, by the first node the local MAC address table that has been stored in the first node; and sending, by the first node, a signal fail, SF, packet to a neighbor node, wherein the SF packet is transferred by using the neighbor node of the first node successively until all the nodes in the ring protection link complete protection against the failure, and the neighbor node comprises the non-SDN device and/or a SDN device. after detecting the failure, updating, by the first node the local MAC address table that has been stored in the first node; and sending, by the first node, a signal fail, SF, packet to a neighbor node, wherein the SF packet is transferred by using the neighbor node of the first node successively until all the nodes in the ring protection link complete protection against the failure, and the neighbor node comprises the non-SDN device and/or a SDN device.