Technical Tip: FortiGate Fails to Categorize API Traffic - Diagnosis and Fixes

[rmehta]

Description	This article describes how to address the 'A rating error occurs' message seen in FortiGate web filtering logs. This indicates that the firewall could not retrieve a valid web category rating from FortiGuard services for certain URLs, which may prevent access depending on the policy.
Scope	FortiGate.
Solution	A Rating Error Occurs: This message appears when a FortiGate firewall attempts to perform a web filter rating request via FortiGuard but fails to receive a valid response. This can result from various network or configuration issues. If the firewall cannot reach the correct FortiGuard server or if the response is delayed or invalid, it logs the following: 'A rating error occurs'. The FortiGate attempts to contact FortiGuard's SDNS (Secure DNS) or web filtering rating servers to categorize a URL. The Following factors are responsible for the occurrence of rating errors: A recent FortiOS upgrade may have changed how FortiGate handles domain categorization and FortiGuard communication. FortiGuard may have updated or deprecated certain FDS or SDNS IPs, making older/default configurations unreliable. New URL patterns (e.g., API endpoints with query strings) may now require real-time categorization instead of static lookups. Changes in DNS infrastructure or ISP policies may now block or delay access to FortiGuard services. Recommendation: Ensure FortiGate has reliable SDNS servers configured: config system fortiguard set sdns-server-ip 208.91.112.55 208.91.112.5 end Check Internet Access to FortiGuard. Cause: Unreachable FortiGuard Distribution Servers (FDS). Missing or default SDNS configuration. Real-time rating required for some URLs. Regional server latency or ISP-related DNS blocks. Related article: Technical Tip: Web Page Blocked 'An error occurred while trying to rate the web site using the webfi...