Anup
I have looked at the additional information that you sent. I think that the biggest issue is the question about the clock messages. I have not been able to find the DSX1-6-CLOCK_CHANGE message documented. If you have access to the Output Interpreter on the Cisco site you might be able to find more about this particular message. (it will want the output of show version and the message output.) I have seen similar messages before. Basically the freerun clock is an internal clock on the 5300 (it uses an oscillator in the router hardware) and is a fallback if the router loses its external clock. The 5300 is configured to use the external clock from controller E1 0 as primary and external clock from controller E1 1 as secondary. The messages that you are seeing indicate that it is losing clocking from controller 0 and uses freerun, then it tries controller 1 for a bit and loses it, it uses freerun again and then tries controller 0 for a bit and reverts to freerun.
I found messages documented that are similar to the message that you are seeing. Most of them indicate that the appropriate action was to open a case with the TAC. I believe that you have very unstable clock. It would be important to get this resolved.
I believe that the problem that you are seeing with ping may very well be caused by the clocking problem. If you get the clocking problem resolved I suspect that the ping problem will go away.
I looked at the debug output and it looks pretty normal to me. There are some things configured in aaa on the 5300 that do not seem to make much sense but I do not think that they hurt anything. You have configured:
aaa authentication login telnet local
aaa authentication login no_tacacs local
With this you have specified two authentication methods (telnet and no_tacacs) but they are not referenced anywhere in the config that you sent. Either you ommitted some parts of the config or these aaa configurations are extraneous.
You also use these same method names in authorization:
aaa authorization exec telnet if-authenticated local
aaa authorization exec no_tacacs local
If they are not being used I would suggest that they be removed.
It is clear that the authentication calls to tacacs are related to this line in the config:
aaa authentication ppp default group tacacs+
It is clear that the authorization calls to tacacs are related to this line in the config:
aaa authorization network default group tacacs+ local
With this the router needs to check with tacacs to start LCP, to start NCP/IPCP, and as part of negotiating the IP address to be used by the caller.
HTH
Rick
HTH
Rick
