Method for checking datagrams transmitted within an industrial automation system, in which - the automation system comprises a plurality of automation cells which are interconnected via an industrial communications network and in each case comprise a firewall interface (111, 121, 131, 141) and a plurality of automation appliances, - datagrams to be checked are transmitted from the automation cells via the respective firewall interface (111, 121, 131, 141) for checking to a firewall system connected at least indirectly to the industrial communications network and are checked there in a rule-based manner, - the firewall system is formed by at least one virtual machine provided within a data processing system comprising a plurality of computer units, characterized in that - a data link layer tunnel is set up in each case between the respective firewall interface (111, 121, 131, 141) and the firewall system in order to transmit the datagrams to be checked, - not only datagrams to be checked, but also at least successfully checked datagrams are transmitted within the respective data link layer tunnel, - datagrams transmitted within the data link layer tunnels are encapsulated in each case into a tunnel datagram which comprises a network layer header and a transport layer header along with the respective datagram, and are transmitted via a transport layer connection between the respective firewall interface (111, 121, 131, 141) and the firewall system, - the firewall system checks datagrams transmitted by the firewall interfaces (111, 121, 131, 141) of the automation cells on the basis of defined security rules, transmits successfully checked datagrams back to the respective firewall interface (111, 121, 131, 141) and rejects datagrams which do not comply with the defined security rules. - the automation system comprises a plurality of automation cells which are interconnected via an industrial communications network and in each case comprise a firewall interface (111, 121, 131, 141) and a plurality of automation appliances, - datagrams to be checked are transmitted from the automation cells via the respective firewall interface (111, 121, 131, 141) for checking to a firewall system connected at least indirectly to the industrial communications network and are checked there in a rule-based manner, - the firewall system is formed by at least one virtual machine provided within a data processing system comprising a plurality of computer units, - a data link layer tunnel is set up in each case between the respective firewall interface (111, 121, 131, 141) and the firewall system in order to transmit the datagrams to be checked, - not only datagrams to be checked, but also at least successfully checked datagrams are transmitted within the respective data link layer tunnel, - datagrams transmitted within the data link layer tunnels are encapsulated in each case into a tunnel datagram which comprises a network layer header and a transport layer header along with the respective datagram, and are transmitted via a transport layer connection between the respective firewall interface (111, 121, 131, 141) and the firewall system, - the firewall system checks datagrams transmitted by the firewall interfaces (111, 121, 131, 141) of the automation cells on the basis of defined security rules, transmits successfully checked datagrams back to the respective firewall interface (111, 121, 131, 141) and rejects datagrams which do not comply with the defined security rules.