L3VPN on Cisco ASR9001 IOS XF 4.3.1 (PE router)

Question

Hi all,
I need to know if this configuration is correct on Cisco ASR 9001 to have L3VPN.
This CISCO should be a PE router (other PE router is in another Autonomous System).
RP/0/RSP0/CPU0:ASR9001-2#sh running-config
Mon Oct  6 06:11:16.434 UTC
Building configuration...
!! IOS XR Configuration 4.3.1
!! Last configuration change at Sun Oct  5 08:23:50 2014 by admin
hostname ASR9001-2
telnet vrf default ipv4 server max-servers 100
ptp
 clock
  domain 1
 profile 1
  multicast
  transport ethernet
  port state slave-only
  clock operation two-step
 profile 2
  transport ethernet
vrf vpnv4
 address-family ipv4 unicast
  import route-target
   65000:111
   65001:111
  export route-target
   65000:111
interface Loopback0
 ipv4 address 10.85.0.67 255.255.255.255
interface Loopback1
 vrf vpnv4
 ipv4 address 2.2.2.2 255.255.255.255
interface MgmtEth0/RSP0/CPU0/0
 shutdown
interface MgmtEth0/RSP0/CPU0/1
 ipv4 address 10.44.107.35 255.255.255.128
interface GigabitEthernet0/0/0/0
 shutdown
interface GigabitEthernet0/0/0/1
 ptp
  profile 2
 shutdown
interface GigabitEthernet0/0/0/2
 shutdown
interface GigabitEthernet0/0/0/3
 shutdown
interface GigabitEthernet0/0/0/4
 shutdown
interface GigabitEthernet0/0/0/5
 shutdown
interface GigabitEthernet0/0/0/6
 shutdown
interface GigabitEthernet0/0/0/7
 shutdown
interface GigabitEthernet0/0/0/8
 shutdown
interface GigabitEthernet0/0/0/9
 shutdown
interface GigabitEthernet0/0/0/10
 shutdown
interface GigabitEthernet0/0/0/11
 shutdown
interface GigabitEthernet0/0/0/12
 shutdown
interface GigabitEthernet0/0/0/13
 shutdown
interface GigabitEthernet0/0/0/14
 shutdown
interface GigabitEthernet0/0/0/15
 shutdown
interface GigabitEthernet0/0/0/16
 shutdown
interface GigabitEthernet0/0/0/17
 shutdown
interface GigabitEthernet0/0/0/18
 shutdown
interface GigabitEthernet0/0/0/19
 shutdown
interface TenGigE0/0/1/0
 mtu 9216
 shutdown
interface TenGigE0/0/1/1
 mtu 9000
 ptp
  profile p1
 ipv4 address 10.85.52.5 255.255.255.252
interface TenGigE0/0/1/2
 shutdown
interface TenGigE0/0/1/3
 mtu 9000
 ipv4 address 10.85.52.1 255.255.255.252
interface TenGigE0/0/2/0
 shutdown
interface TenGigE0/0/2/1
 shutdown
interface TenGigE0/0/2/2
 shutdown
interface TenGigE0/0/2/3
 shutdown
router static
 address-family ipv4 unicast
  10.40.0.0/14 10.44.107.1
  141.0.0.0/8 10.44.107.1
router ospf 1
 router-id 10.85.0.67
 mpls ldp sync
 mpls ldp auto-config
 area 0.0.0.0
  mtu-ignore enable
  interface Loopback0
   passive enable
  interface TenGigE0/0/1/1
  interface TenGigE0/0/1/3
router bgp 65000
 bgp router-id 10.85.0.67
 address-family ipv4 unicast
  network 10.85.0.67/32
 address-family vpnv4 unicast
 neighbor 10.85.0.71
  remote-as 65000
  update-source Loopback0
  address-family ipv4 unicast
  address-family vpnv4 unicast
 neighbor 10.85.0.72
  remote-as 65000
  update-source Loopback0
  address-family ipv4 unicast
  address-family vpnv4 unicast
 vrf vpnv4
  rd 10.85.0.67:111
  address-family ipv4 unicast
   redistribute connected
   redistribute static
mpls ldp
 router-id 10.85.0.67
 interface TenGigE0/0/1/1
 interface TenGigE0/0/1/3
ssh server v2
ssh server session-limit 100
end

Answer 1

"New pin mode is not supported if you are using the RSA native protocol."
I am very aware of this.
"Use the Radius protocol on the RSA Authentication Manager for features like New pin , next token mode etc."
I am also very aware of this too.
However, I do not want to use radius on the
RSA Authentication Manager. I want to use
tacacs+ in the ACS but off-load the
authentication database piece to RSA. I
want to use tacacs because I want to have
separations between Authentication and
Authorization, which is not possible with
radius.
From the router's perspective, it does not
know anything about RSA, it only knows ACS.
Are you saying that even though ACS passes the
credentials to RSA, it is still RSA native
protocol? i.e. udp port 5500?
Thanks.