Method for checking datagrams transmitted within an industrial automation system, in which - the automation system comprises a plurality of automation cells (101-104) which are interconnected via an industrial communications network and in each case comprise a firewall interface and a plurality of automation appliances, - datagrams to be checked are transmitted from the automation cells (101-104) via the respective firewall interface for checking to a firewall system connected at least indirectly to the industrial communications network and are checked there in a rule-based manner, - the firewall system is formed by at least one virtual machine provided within a data processing system comprising a plurality of computer units, characterized in that - a data link layer tunnel (311-314) is set up in each case between the respective firewall interface and the firewall system in order to transmit the datagrams to be checked, - not only datagrams to be checked, but also at least successfully checked datagrams are transmitted within the respective data link layer tunnel (311-314), - datagrams transmitted within the data link layer tunnels (311-314) are encapsulated in each case into a tunnel datagram which comprises a network layer header and a transport layer header along with the respective datagram, and are transmitted via a transport layer connection between the respective firewall interface and the firewall system , - the firewall system checks datagrams transmitted by the firewall interfaces of the automation cells (101-104) on the basis of defined security rules, transmits successfully checked datagrams back to the respective firewall interface and rejects datagrams which do not comply with the defined security rules. - the automation system comprises a plurality of automation cells (101-104) which are interconnected via an industrial communications network and in each case comprise a firewall interface and a plurality of automation appliances, - datagrams to be checked are transmitted from the automation cells (101-104) via the respective firewall interface for checking to a firewall system connected at least indirectly to the industrial communications network and are checked there in a rule-based manner, - the firewall system is formed by at least one virtual machine provided within a data processing system comprising a plurality of computer units, - a data link layer tunnel (311-314) is set up in each case between the respective firewall interface and the firewall system in order to transmit the datagrams to be checked, - not only datagrams to be checked, but also at least successfully checked datagrams are transmitted within the respective data link layer tunnel (311-314), - datagrams transmitted within the data link layer tunnels (311-314) are encapsulated in each case into a tunnel datagram which comprises a network layer header and a transport layer header along with the respective datagram, and are transmitted via a transport layer connection between the respective firewall interface and the firewall system , - the firewall system checks datagrams transmitted by the firewall interfaces of the automation cells (101-104) on the basis of defined security rules, transmits successfully checked datagrams back to the respective firewall interface and rejects datagrams which do not comply with the defined security rules. <EOS>