Troubleshooting Tip: DNS rating error occurs (no available FortiGuard SDNS servers)

[navellano]

Description	This article describes the basic troubleshooting when  a DNS rating error is encountered (no available FortiGuard SDNS servers).
Scope	FortiGate v6.0 and above.
Solution	SDNS servers are DNS servers used by DNS filter profiles. The DNS lookup requests will be sent to the FortiGuard DNS service and resolve end-user queries with an IP address and a domain rating that includes the FortiGuard category of the web page. The SDNS server IP address might be different depending on location.   The default FortiDNS server is located in the USA (IP address: 208.91.112.220), and the in the London server, UK (IP address: 194.69.172.53). Follow the steps below  the DNS rating error is appaearing (no available FortiGuard SDNS servers): By default, FortiGate uses UDP port 53 to connect to the SDNS server. Verify the connection between FortiGate and the SDNS server: Run below command to verify the FortiGuard SDNS server. diagnose test application dnsproxy 3 From the output of the above command, check the FGD_DNS_SERVICE_LICENSE line.The SDNS server IP address might be different depending on location. In this example, it is: Verify the communication between the FortiGate and the SDNS server. In the CLI Console: execute ping 208.91.112.220 Note: If VDOM is enabled, run the command under management VDOM. Modify the FortiGuard setting through CLI console: config system fortiguard     set fortiguard-anycast disable     set protocol udp     set port 8888     set sdns-server-ip 208.91.112.220 173.243.140.53 210.7.96.53 The North American server should work in most cases. However, it is possible to switch to the European server (IP address: 194.69.172.53) to see if it improves latency. This command can be used to check the DNS proxy status. Use '?' to list down the Test level. diagnose test application dnsproxy ? Clear DNS cache Show stats Dump DNS setting Reload FQDN Requery FQDN Dump FQDN Dump DNS cache Dump DNS DB Reload DNS DB Dump secure DNS policy/profile Dump Botnet domain Reload Secure DNS setting Show Hostname cache Clear Hostname cache Show SDNS rating cache Clear SDNS rating cache DNS debug bit mask Restart dnsproxy worker Related documents: Troubleshooting for DNS filter (Optional) Changing the FortiDNS server and port

[janonuevo]

This is very informative and helpful. Kudos to the Author!