In this paper we present techniques and protocols for protecting a network against multiple link failures. The existing link-based restoration with MPLS Fast Re-route (FRR) is fast, but can create congestion by overloading edges, which is undesirable since many applications are sensitive to congestion-related packet loss. The problem is exacerbated with multiple link failures, frequent enough to be of concern in production networks. In this paper we investigate enhancements to FRR restoration in the presence of multiple failures through network and protocol design. We describe several network designs that add a small number of edges to an existing topology, intended for use by backup paths. For each design, we describe a protocol (that piggybacks on OSPF) for distributing state information and a distributed algorithm for reconfiguring backup paths, after each failure, based on the state information. We prove that for any k, our design, associated protocol, and distributed backup path reconfiguration scheme can handle k arbitrary link failures without causing disconnection or congestion. Through a series of constructions, our final network design is nearly optimal with respect to the number of additional edges in the topology. We believe that these network designs are the first to have such provable guarantees for failures of arbitrary multiplicity.