TACACS fails authentication with weird error message

[mattw]

Hi,

I'm setting up ISE for TACACS for a customer. ISE 3.0 patch 3.

The NADs are "Versa Director" SD-WAN.

SSH works absolutely fine, correct authc policy hits, correct authz policy hits and correct result is pushed. Lovely.

But for GUI access it is not working. I see entries in the TACACS live logs but it does not appear to actually hit an authentication policy. It just says: 

Message Text - TACACS: TACACS+ will use the password prompt from global TACACS+ configuration

...this does not give much away??

Please see attached Word Doc with screenshots.

Any ideas anyone?

Many thanks in advance,

Matt.

[mattw · Accepted solution]

Fixed it - had to disable single connect mode under the network device configuration in ISE.

Hopefully this might help somebody else in the future with a similar issue.