Troubleshooting Tip: DNS Filter Rating Server Unreachable

[vbandha]

Description	This article describes troubleshooting steps if the DNS Filter Rating Server is visible as unreachable.
Scope	FortiGate v7.0+.
Solution	The DNS Filter rating server is visible as unreachable under Network -> DNS settings, follow these steps for troubleshooting: Check the status of the FortiGuard server on this link: http://status.fortimonitor.forticloud.com/fortiguardsdns If the status is down or there are incidents reported, then change the DNS server from Fortiguard to public DNS server. Change DNS settings. To do this, go to Network -> DNS. Choose 'Specify' and enter the public DNS IP (eg 8.8.8.8 or 1.1.1.1) and make sure UDP/53 is enabled and TLS is disabled. Change Fortiguard settings. Open a CLI window and type these commands if located in US: set fortiguard-anycast disable set protocol udp set port 53 set update-server-location usa set sdns-server-ip "208.91.112.220" end If located outside the US, then type these commands: set fortiguard-anycast disable set protocol udp set port 53 set update-server-location automatic set sdns-server-ip "194.69.172.53" end The SDNS server 208.91.112.220 is located in California, US. The server 194.69.172.53 is located in London, UK  Check Fortiguard DNS Rating Server License. In the CLI Console, run the command: diagnose test application dnsproxy 3 Check the expiry date under the LICENSE line and make sure it is not expired.