Okay here is the scenario. I have a ACS server that all network devices use TACACS through. Switches in zone 3 and zone 4 of the firewall use NAT to access the ACS server. The NAT address is the outside interface of the firewall. Switches in zone 3 are managed by a NMS w/ an IP of 192.168.1.1 and are able to authenticate with the TACACS server with no issues. Switches in zone 4 are managed by a NMS w/ an IP of 192.168.5.1 and are not able to authenticate with the TACACS server. The switch configs for zone 3 and 4 are identical minus switch specific items and the firewall has the proper ACLs to allow the traffic. Upon reviewing the ACS logs, when a switch in zone 4 tries to authenticate it lists "13036 Selected Shell Profile is DenyAccess". Both zones are using the same service account information to authenticate and both NMS boxes are in the end station filter for that account. For argument's sake let's assume for the time being the configs for the switches and firewall are correct. Is there something else on the ACS server that could be stopping switches in zone 4 from authenticating?
