RADIUS uses UDP, and not TCP.
You have erroneously specified TCP in many of your Access Control Entries, and you have specified destination ports 1645 and 1646 on the RADIUS server which I do not believe is necessary.
Assuming you have performed some action that would have resulted in an AAA operation since the counters were last reset, I would expect the hit counts for the following two ACEs to be non-zero:
access-list 100 line 79 extended permit udp any host 55.55.55.21 eq 1812 (hitcnt=0) 0x434c493f
access-list 100 line 80 extended permit udp any host 55.55.55.21 eq 1813 (hitcnt=0) 0x68f2332e
... the fact that they are zero "may" suggest that the ACEs are applied on the wrong interface, or in the wrong direction, or a more permisive ACE is being matched.
The following two ACEs can be deleted because they specify TCP, and UDP versions of these are in effect above:
access-list 100 line 85 extended permit tcp any host 55.55.55.21 eq 1812 (hitcnt=0) 0x1eaca25d
access-list 100 line 86 extended permit tcp any host 55.55.55.21 eq 1813 (hitcnt=0) 0xdfdcbee0
The following two ACEs can be deleted because they specify TCP, and I don't beleive you need to create UDP versions of them because I don't beleive your ASA is sending packets to these ports on the RADIUS server:
access-list 100 line 87 extended permit tcp any host 55.55.55.21 eq 1645 (hitcnt=0) 0xa53ef213
access-list 100 line 88 extended permit tcp any host 55.55.55.21 eq 1646 (hitcnt=0) 0xb9e532a6
You "may" need to retain the following two ACEs "if" you have other AAA Clients using local UDP ports 1812 and 1813 (I think your ASA is listening on 1645 and 1646):
access-list 101 line 33 extended permit udp host 55.55.55.21 any eq 1812 (hitcnt=0) 0x1b49f068
access-list 101 line 34 extended permit udp host 55.55.55.21 any eq 1813 (hitcnt=0) 0xc4ebdbc9
The following two ACEs can be deleted because they specify TCP, and UDP versions of these are in effect above:
access-list 101 line 41 extended permit tcp host 55.55.55.21 any eq 1812 (hitcnt=0) 0x20268376
access-list 101 line 42 extended permit tcp host 55.55.55.21 any eq 1813 (hitcnt=0) 0x23741a92
The following two ACEs need to be amended (UDP, not TCP), to support return traffic to the ASA which I believe is listening on UDP ports 1645 and 1646:
access-list 101 line 43 extended permit tcp host 55.55.55.21 any eq 1645 (hitcnt=0) 0xb52e86b8
access-list 101 line 44 extended permit tcp host 55.55.55.21 any eq 1646 (hitcnt=0) 0x4599a6ce
The messages in your original post suggest that accounting is working (you haven't suggested otherwise), despite the fact that none of the ACEs provided show any hits. I don't know if you have a more permisive ACE that is being matched or if you reset the counters prior to pasting the ACEs in your most recent post.
I still think you should use a sniffer to verify that the ASA is using ports 1645 and 1646 locally to communicate with ports 1812 and 1813 on the RADIUS server. Then review your ACLs to ensure that your ACEs are constructed accordingly, and that your ACLs are applied in the correct direction, on the correct interfaces. The hit counters are an easy means of verification.
