We consider protection switching in an IP over optical network. There is IP Fast Reroute Loop-free Alternates (IP FRR LFA) at the IP layer, and protection switching at the optical layer. Our network model assumes a completely connected IP network over an optical ring network that is required to protect a predetermined fraction of network bandwidth. This model leads to analytical formulas on network protection costs which we show are accurate. We also show that network cost is at or near zero when the network is required to protect at most 33% of traffic. A cost comparison to networks using MPLS Fast Reroute (MPLS FRR) further indicates that LFA is a feasible protection mechanism.