I had a similiar issue with a Nexus 5020 authenticating our Ciscoworks account and giving the illegal user log message.  Other users were connecting fine.Debugs showed TACACS failing to resolve the Ciscowrks servers hostname in a reverse lookup.I re...