A security protection method, comprising: obtaining, by a source device, a security level of a first virtual local area network VLAN, wherein the source device and a destination device corresponding to the source device are devices in the first VLAN, the first VLAN is one of a plurality of VLANs comprised in an Ethernet, each of the plurality of VLANs corresponds to one security level, and the security level of each of the plurality of VLANs is preset; and determining, by the source device using the security level of the first VLAN, whether to perform security protection on data to be sent to the destination device; characterized in that when the source device determines, using the security level of the first VLAN, to perform security protection on the data to be sent to the destination device, the method further comprises: encapsulating, by the source device, a first packet using a header of the first VLAN, to obtain a second packet, wherein the header of the first VLAN comprises a first field, a counter-related PN field, and a decryption type-related AE field, the first field is used to indicate the destination device to perform security verification on the data sent to the destination device, the PN field is used by the destination device to verify whether the data sent to the destination device is replayed data, the AE field is used by the destination device to determine whether to decrypt the data sent to the destination device, and wherein the first packet is a packet obtained after the source device encapsulates, using an identifier ID of the first VLAN, the data to be sent to the destination device. obtaining, by a source device, a security level of a first virtual local area network VLAN, wherein the source device and a destination device corresponding to the source device are devices in the first VLAN, the first VLAN is one of a plurality of VLANs comprised in an Ethernet, each of the plurality of VLANs corresponds to one security level, and the security level of each of the plurality of VLANs is preset; and determining, by the source device using the security level of the first VLAN, whether to perform security protection on data to be sent to the destination device; characterized in that when the source device determines, using the security level of the first VLAN, to perform security protection on the data to be sent to the destination device, the method further comprises: encapsulating, by the source device, a first packet using a header of the first VLAN, to obtain a second packet, wherein the header of the first VLAN comprises a first field, a counter-related PN field, and a decryption type-related AE field, the first field is used to indicate the destination device to perform security verification on the data sent to the destination device, the PN field is used by the destination device to verify whether the data sent to the destination device is replayed data, the AE field is used by the destination device to determine whether to decrypt the data sent to the destination device, and wherein the first packet is a packet obtained after the source device encapsulates, using an identifier ID of the first VLAN, the data to be sent to the destination device.