We study an approach to quality-of-service (QoS) that offers end-users the choice between two service classes defined according to their level of transmission protection. The fully protected (FP) class offers end-users a guarantee of survivability in the case of a single-link; all FP traffic is protected using a 1:1 protection scheme at the WDM layer. The second class of service, called Best-Effort Protected (BEP), is not protected; instead restoration at the IP layer is provided. The FP service class mimics what Internet users receive today. The BEP traffic is designed to run over the large amounts of unused bandwidth that exist in today`s Internet. The motivation of this approach is to give carriers a mechanism for increasing the load carried on backbone networks without reducing the QoS received by existing customers. In order to support two such services, we have to solve two problems: the off-line problem of mapping logical links to pairs of disjoint fiber paths, and an on-line scheduling problem for differentiating packets from two classes at the IP layer. We provide an algorithm based on a Tabu Search meta-heuristic to solve the mapping problem, and a simple but efficient scheduler based on Weighted Fair Queuing for service differentiation at the IP layer. We consider numerous requirements that carriers face and illustrate the tradeoffs they induce. We evaluate the throughput, delay and loss performance of the two traffic classes and illustrate that we can successfully increase the total network load by a factor between three and ten and still meet all the carrier requirements.