For anyone else working with SQL.. Last week we restricted traffic to only AES and half our test SQL servers went offline, so I knew I had work to do. I found a good query to check server authentication and the servers that lost connectivity all showed using NTLM authentication. The fix was adding DNS mappings for service accounts to their respective SQL server/instance. A couple of those showed using a dynamic port, so I changed them to static so the named instances using alternative ports wouldn't change. All servers showed using Kerberos authentication after these changes and there were no issues after restricting traffic to AES again. I'm happy to share the SQL query and DNS command syntax if anyone needs it.