A resilient virtual Ethernet ring has nodes interconnected by working and protection paths. Each node has a set of VLAN IDs (VIDs) for tagging traffic entering the ring by identifying the ingress node and whether the traffic is on the working or protection path. MAC addresses are learned in one direction around the ring. A port aliasing module records in a forwarding table a port direction opposite to a learned port direction. Each node can also cross-connect working and protection paths. If a span fails, the two nodes immediately on either side of the failure are cross-connected to fold the ring. Working-path traffic is cross-connected onto the protection path at the first of the two nodes and is then cross-connected back onto the working path at the second of the two nodes so that traffic always ingresses and egresses the ring from the working path.