A Virtual Private Network (VPN) alms to emulate the services provided by a private network over the shared Internet. The endpoints of a VPN tire connected using abstractions such as Virtual Channels (VCs) of ATM or Label Switching Paths (LSPs) of MPLS technologies. Reliability of an end-to-end VPN connection depends on the reliability of the links and nodes in the fixed path that it traverses in the network. In order to ensure service quality and availability in a VPN, seamless recovery from failures is essential. This work considers the problem of fast recovery in the recently proposed VPN hose model. In the hose model bandwidth is reserved for traffic aggregates instead of pairwise specifications to allow any traffic pattern among the VPN endpoints. This work assumes that the VPN endpoints are connected using a Owe structure and at any time, at most one tree link can fail (i.e., single link failure model). A restoration algorithm must select a set of backup edges and allocate necessary bandwidth on them in advance, so that the traffic disrupted by failure of a primary edge can be re-routed via backup paths. We aim at designing an optimal restoration algorithm to minimize the total bandwidth reserved on the backup edges. This problem is a variant of optimal graph augmentation problem which is NP-Complete. Thus, we present a polynomial-time approximation algorithm that guarantees a solution which is at most 16 times of the optimum. The algorithm is based on designing two reductions to convert the original problem to one of adding minimum cost edges to the VPN tree so that the resulting graph is 2-connected, which can be solved in polynomial time using known algorithms. The two reductions introduce approximation factors of 8 and 2, respectively, thus resulting in a 16-approximation algorithm with polynomial time complexity.