# Troubleshooting
<a name="troubleshooting"></a>

Some things to try if you run into trouble:
+ The AMS-managed Active Directory outbound security group needs to be allowed connection through your CIDR block (e.g. 10.27.0.0/16) to your domain controller.
+ Trace the route in the AWS Console from domain controller to domain controller checking all security groups along the way.
+ Make sure you can ping the AMS-managed Active Directory Domain Controllers if Internet Control Message Protocol (ICMP) is allowed. 
+ Make sure your Domain Controller can communicate with AWS Directory Services.
+ Make sure the conditional forwarders resolve and are validated.
+ If you do not see **Forest Trust** in the New Trust wizard, then your conditional forwarders may not be working correctly:
  + Use nslookup to test resolution
  + Try rebooting the Domain Controller