Technical Tip: FortiGate Fails to Categorize API Traffic - Diagnosis and Fixes

1. A Rating Error Occurs:

This message appears when a FortiGate firewall attempts to perform a web filter rating request via FortiGuard but fails to receive a valid response. This can result from various network or configuration issues.

• If the firewall cannot reach the correct FortiGuard server or if the response is delayed or invalid, it logs the following: 'A rating error occurs'.
• The FortiGate attempts to contact FortiGuard's SDNS (Secure DNS) or web filtering rating servers to categorize a URL.

2. The Following factors are responsible for the occurrence of rating errors:

A recent FortiOS upgrade may have changed how FortiGate handles domain categorization and FortiGuard communication.

FortiGuard may have updated or deprecated certain FDS or SDNS IPs, making older/default configurations unreliable.

New URL patterns (e.g., API endpoints with query strings) may now require real-time categorization instead of static lookups.

Changes in DNS infrastructure or ISP policies may now block or delay access to FortiGuard services.

Recommendation:

• Ensure FortiGate has reliable SDNS servers configured:

config system fortiguard

set sdns-server-ip 208.91.112.55 208.91.112.5

end

• Check Internet Access to FortiGuard.

Cause:

• Unreachable FortiGuard Distribution Servers (FDS).
• Missing or default SDNS configuration.
• Real-time rating required for some URLs.
• Regional server latency or ISP-related DNS blocks.

Related article:

Technical Tip: Web Page Blocked 'An error occurred while trying to rate the web site using the webfiltering service'