[ 0042 ] fig1 is a block diagram that schematically illustrates a vpn 20 with a hierarchical vpls topology , implementing a protection scheme in accordance with a preferred embodiment of the present invention . vpn 20 is built around a virtual private lan service ( vpls ), operating within a network 22 , typically an ip or mpls network . the vpls is based on virtual bridges 30 , 32 , 34 , 36 , 38 , and 40 , or vpls - capable pes , which are connected by pws 70 , 72 , 74 and 76 through network 22 . although for clarity of illustration , network 22 includes only a small number of pes and represents only a single vpls instance , the principles embodied in this network may be extended in a straightforward manner to larger networks and to multiple vpls instances . three primary virtual bridges 30 , 32 and 34 , referred to as primary core nodes , are connected with each other in a full mesh with pw connections 70 . typically , the pw connections comprise mpls tunnels , but they may alternatively comprise virtual connections of other types , such as gre or l2tp tunnels . each of the primary core nodes 30 , 32 and 34 , is paired with a corresponding backup virtual bridge , referred to as a standby core node , 36 , 38 and 40 , respectively . the standby core nodes are connected in the network by redundant backup connections 72 . each standby core node has a topology identical to its corresponding primary core node . for example , standby core node 36 has the same topology image as primary core node 30 . each of the primary and standby core nodes is connected to all the other core nodes in the network except for the standby or primary core node with which it is paired . an optional connection 79 between a primary core node and its corresponding standby core node may also be included , as described hereinbelow . the core nodes are configured to support a split horizon model . connections 74 and 76 are made between the core nodes and edge nodes 50 , 52 , 54 , 56 , 58 and 60 , as shown in fig1 . for the sake of simplicity in this figure , only two edge nodes are shown to be connected to each core node . edge nodes are in turn connected to user terminals via physical interfaces 78 , which are typically ethernet interfaces , but may alternatively be interfaces of other types , such as frame relay or atm circuits . the vpls and lan topologies shown in fig1 are chosen by way of example , and the principles of the present invention may be applied , mutatis mutandis , to alternative vpls and lan topologies , as well . if a primary core node fails , all connections 70 , 74 and 72 to the failed primary core node are no longer used . backup connections 72 and 76 to the corresponding standby core node are used instead . for example , if primary core node 30 fails , edge nodes 50 and 52 , which prior to the failure had been communicating through pw connections 74 with primary core node 30 , begin instead to communicate with standby core node 36 through pw connections 76 . the other core nodes ( typically primary core nodes 32 and 34 , but possibly standby core nodes 38 and 40 if there were other primary core node failures ) begin to use backup pw connections 72 to communicate with standby core node 36 . since the topological position of standby core node 36 is identical to that of primary core node 30 , the remaining nodes in the network may continue to use the pw associations in their mac tables that they learned before the failure , except that the tables now point to the backup connections instead of the failed primary connections . the other nodes simply redirect all packets that were supposed to be sent to the failed primary core node 30 to the standby core node 36 that protects it . detection of and response to core node failure proceeds as follows : core node failures are initially detected by edge nodes , using either existing signaling protocols ( such as “ hello ” messages provided by the label distribution protocol — ldp ), or using special “ ping ” operations or oam ( operations , administration , and management ) connectivity verification if such a signaling protocol is not available or if faster response is required . some special network topologies , such as resilient packet rings -( rpr ), have built - in topology discovery protocols , enabling very fast detection of node failures . upon noticing the failure of a primary core node , all the edge nodes that are connected through point - to - point pws to the failed primary core node begin communicating through the corresponding standby core node . the standby core node , which is “ always on ,” then begins relaying the traffic it receives from the edge nodes . other core nodes in the network , upon receiving this traffic from the standby core node , stop communicating through the failed primary core node and being communicating instead through the corresponding standby core node . note that this protection scheme does not rely on any special communication protocol between a primary core node and its corresponding standby core node . if a suitable signaling protocol is available , however , between the primary and standby core nodes ( like the ldp “ hello ” or “ ping ” methods noted above ), faster recovery of the network may be possible . for example , if primary core node 30 fails , edge nodes 50 and 52 detect this failure by one of the methods described above . edge nodes 50 and 52 then start directing traffic through standby core node 36 . standby core node 36 relays the traffic to other core nodes in the network . upon receiving this traffic , the other core nodes in the network begin redirecting traffic formerly directed to primary core node 30 , to flow through standby core node 36 instead . a simple communications protocol for synchronizing mac table databases between each pair of primary and standby core nodes can be invoked regularly to update the standby core node with the current mac forwarding table stored in the corresponding primary core node . in this way , if a primary core node fails , the mac table database of the corresponding standby core node is closely synchronized with the mac table database of the failed node , and flooding caused by unknown mac addresses is limited to the mac addresses learned by the failed node since the last synchronization . networks designed in accordance with the present invention can handle certain multiple core node failures , on the condition that at least one node from each pair of primary and standby core nodes does not fail . for example , if primary core node 30 fails , edge node 50 can stop communicating with core node 30 through point - to - point pw connection 74 , and instead begin communicating with standby core node 36 through backup point - to - point pw connection 76 . if primary core node 34 now also fails , the remaining active core nodes , including standby core node 36 , will switch to communicating through pw 72 with standby core node 40 . in this situation edge node 50 can still communicate with edge node 58 through the backup connections and nodes . alternatively , instead of a one - to - one pairing of primary and standby core nodes , a single standby core node can be assigned to protect multiple primary core nodes , thus reducing the number of core nodes and the number of bi - directional connections in the core side of the network . this approach may be desirable in large networks , where the number of connections may be high . for example , in the absence of standby core node 36 , node 40 may be used to protect against failure of primary core node 30 , as well as primary core node 34 . in this case , edge nodes 50 and 52 are connected by backup connections 76 to node 40 . upon detecting a failure of node 30 , nodes 32 and 34 send all packets destined for node 30 , to node 40 , instead . this change in topology , however , may require either more complicated mac database coordination between the core nodes , or mac table clearing after a failure occurs , which may cause packet flooding until the mac learning database is re - stabilized . after failure , if a primary core node becomes active again , a number of methods may be used for restoring traffic to it if desired . for example , the standby cores node may use a standard or dedicated signaling protocol to detect that the primary core node has again become active . in this case , the corresponding standby core node may issue a command to all the edge nodes that have point - to - point pw connections with the primary core node , instructing them to revert to using the connections with the primary core node . this approach has the benefit of making possible a synchronized topology change , avoiding a situation in which some edge nodes direct traffic through the primary core node , while other edge nodes direct traffic through the corresponding standby core node . an alternative method of restoration of traffic to a primary core node is as follows : once the primary core node becomes active again , the signaling of network connections between each edge node and the primary core node is re - established . upon noticing this signaling , each edge node can begin to use its connection to the primary core node instead of the connection to the standby core node . in other words , restoration of traffic to the primary core node is carried out by a similar mechanism to that used to divert the traffic to the standby core node when the primary core node fails . in this case , however , topology recovery may be not synchronized over the whole network , so that some core nodes may continue sending traffic through the standby node for a while . the edge nodes should be therefore capable of receiving packets simultaneously from both the standby and the primary core nodes , while sending upstream packets from users to only one of these core nodes . to protect against a single connection failure between an edge node and a core node , it is useful to add an additional point - to - point connection 79 , preferably a pw connection , between each primary core node and its corresponding standby core node . these additional connections can be used to bridge between different edge nodes connected by point - to - point pw connections to the same primary and standby core nodes , as follows : if a connection between an edge node and a primary core node fails , the edge node will start to use the corresponding standby core node , even if the primary core node itself has not failed . thus , it may occur that some edge nodes continue to communicate with the primary core node while other edge nodes communicate with the corresponding standby core node . layer 2 connectivity is still maintained between all the edge nodes , however , through the use of additional connection 79 between the primary and standby core nodes . if such an additional connection is used , the corresponding standby core node should typically not send traffic toward the full mesh of connections 72 unless the primary core node itself has failed . [ 0057 ] fig2 is a block diagram that schematically shows a detail of vpn 20 , illustrating an alternative configuration of the edge nodes , in accordance with a preferred embodiment of the present invention . the figure shows a pair of corresponding primary and standby core nodes 80 and 82 , which are capable of split horizon operation between a core mesh of connections 70 and 72 and access mesh of connections 74 and 76 . edge nodes 84 , 86 and 88 are connected to core nodes 80 and 82 by connections 74 and 76 , and are capable of bridging in a full mesh topology created by additional connections 90 between all the edge nodes . alternatively , other vpls and lan topologies may be used to connect the edge nodes to the core nodes , as well , as will be apparent to those skilled in the art . as in the embodiment of fig1 in normal operation , edge nodes 84 , 86 , and 88 communicate through connections 74 with primary core node 80 , but in this case they communicate through connections 90 among themselves . if primary core node 80 fails , edge nodes 84 , 86 , and 88 begin communicating through backup connections 76 with the corresponding standby core node 82 . [ 0059 ] fig3 is a block diagram that schematically shows vpn 20 in an alternative configuration , in accordance with a preferred embodiment of the present invention . the motivation for this configuration is to lower the number of connections in the core of network 22 , at the cost of reduced immunity to multiple nodes failure . although normal connections 70 are configured as in the preceding embodiment , each of the standby core nodes in the present embodiment is connected by only a single backup connection 72 to one of the primary core nodes . in the absence of any failure , the operation of the network is identical to that described earlier . if one of the primary core nodes fails , however , for example node 30 , the spokes attached to it start to use standby core node 36 , as described above . the topology image of the network is now changed , and the other core nodes must now communicate with node 36 through node 34 , rather than directly . the other primary core nodes may adjust to the change in topology in various ways . in one preferred embodiment , when the other nodes detect the failure , they simply flush the mac table database entries associated with connections 70 that were used to communicate with node 30 . in another preferred embodiment , each node knows in advance which node is on the alternative path to the standby core node corresponding to each of the primary core nodes . in this case , the other core nodes automatically re - associate the mac addresses that were previously associated with the connection to the failed node , so that these addresses are associated instead with the connection to the node on the alternative path . ( these new associations in the mac table are in addition to the already known mac addresses learned normally on the same connection .) continuing with the above example , prior to the failure in node 30 , node 32 will have learned to associate one set of mac addresses with connection 70 to node 34 , and to associate another set with connection 70 to node 30 . node 32 also knows ( by means of configuration settings ) that in case of failure in node 30 , the corresponding standby node 36 is to be accessed through node 34 . therefore , when the failure occurs , node 32 simply combines the two sets of mac addresses into one set , which is associated with the connection to node 34 . although network 22 , as described hereinabove , uses certain particular protocols for communication routing and tunneling , the principles of the present invention may similarly be applied using protocols and virtual bridges of other types . it will thus be appreciated that the preferred embodiments described above are cited by way of example , and that the present invention is not limited to what has been particularly shown and described hereinabove . rather , the scope of the present invention includes both combinations and subcombinations of the various features described hereinabove , as well as variations and modifications thereof which would occur to persons skilled in the art upon reading the foregoing description and which are not disclosed in the prior art .