A node within a mesh network includes an Optical Connection Controller (OCC) and a network element. When a connection path within the mesh network is required, an OCC determines if a particular connection path requires a network element to operate as a virtual gateway to separate the mesh network into separate protection domains for that particular connection path. A connection path might require separate protection domains in cases in which the number of network elements and/or repeater/amplifier components for a particular connection path is greater than a threshold, the total length of links for the connection path is above a threshold and/or another factor that could cause the recovery time for the connection path to increase beyond an acceptable threshold level. If the OCC determines that one or more virtual gateways are required for a particular connection path, the OCC selects an appropriate network element within the network to operate as a virtual gateway for that particular connection path. Finally, the OCC assigns network elements and links to establish working and protection paths between the source network element and the virtual gateway and between the virtual gateway and the destination network element. This set-up can ensure that each connection path will have a recovery time after a failure within an acceptable range.