If you're able to, can you share the VTY and AAA configs? (You can mask anything that you don't want to disclose).
NETCONF uses the default method to login. If you have a custom method defined, NETCONF won't use that line. Also, are you using local or AAA credentials for CLI credentials?
For example, lets say this is your AAA config:
aaa new-model
aaa authentication login custom_method group aaa-group local
aaa authorization exec custom_method group aaa-group local if-authenticated
Above we're using a custom method. Since NETCONF uses the default method, you have to add two lines for it. This adds to and does not replace the above config:
aaa authentication login default group aaa-group local
aaa authorization exec default group aaa-group local if-authenticated
So your config becomes:
aaa new-model
aaa authentication login default group aaa-group local
aaa authentication login custom_method group aaa-group local
aaa authorization exec default group aaa-group local if-authenticated
aaa authorization exec custom_method group aaa-group local if-authenticated
You can also enable AAA debugs on the device, and 'validate credentials' from the Catalyst Center GUI to see what the issue may be:
# debug aaa authentication
# debug aaa authorization
# term mon
