Question about Cisco Network Assistant and authentication

Question

I'm trying to manage several 3750 stacks using CNA and it's able to authenticate with all but two of the stacks (these are NOT cluster members).  During the discovery process, CNA keeps prompting for a username/password.  We use TACACS+ so I give it the same username/password that I would when I login using SSH.  Here's where things come off the rails for me.  If I go to my ACS server and pull up troubleshooting and the load up CNA I do not see any activity.  If I turn on debugs on the switch here's the output I get while trying to connect with CNA:
3750-Fire-Access-Sw2#show debug
General OS:
  TACACS+ events debugging is on
  TACACS+ authentication debugging is on
  TACACS+ authorization debugging is on
  TACACS+ packets debugging is on
  AAA Authentication debugging is on
  AAA Authorization debugging is on
HTTP Server:
  HTTP Server Authentication debugging is on
3750-Fire-Access-Sw2#termin
3750-Fire-Access-Sw2#terminal mon
3750-Fire-Access-Sw2#terminal monitor
3750-Fire-Access-Sw2#
Mar  4 16:26:19: HTTP: Authentication failed for level 15
The funny thing is that if I do these same debugs on a switch that works I get this:
3750-Saints-Access#
Mar  4 16:32:25: HTTP: Priv level granted 15
Mar  4 16:32:25: AAA/BIND(000005A8): Bind i/f
(this is repeated several dozen times)
My understanding of ip http is that if no authentication is enabled it uses the authenication method used by vty (the switch is using http server version 1).  The switch is configured to use aaa/tacacs for vty.  If that is the case then why don't I see activity in ACS and why don't a see a bunch of output from all of the other debugs?  How is CNA authenticating with the switch? 

Answer 1

Does anybody else think Cisco's aaa new-model configuration is as clear as mud?  For what it's worth, I figured out the problem (just in case anybody else has the same issue).  What killed me was this line:
aaa authentication enable default group tacacs+ enable
There's nothing wrong with this command.  I think all it's saying is exec privilege can be provided by tacacs+ OR the locally configured enable secret/password.  The problem for me was that the user account I was using to login just happened to have a different password (in Active Directory) than it did on the local switch for TWO of the ten switch stacks I was trying to group together.  The other switch stacks had the same enable secret as the user account's password.  Now what I don't understand is why the switch decided to look at the enable secret first before trying tacacs.  That doesn't seem logical to me.  How does the switch make this decision?  Is that documented anywhere?