1.first step that we have to check the network reachablitiy to the tacacs server from the switch by pinging server ip,if its fine we move to next step

2. Then we suggest the customer to use only one tacacs template and if they have two tacacs server then mark it as secondary in the same  and map it to default_admin domain,changed configuration as follows

hwtacacs-server template XYZ

 hwtacacs-server authentication 10.0.0.1

 hwtacacs-server authorization 10.0.0.1

 hwtacacs-server accounting 10.0.0.1

hwtacacs-server authentication 192.168.1.1 secondary

 hwtacacs-server authorization 192.168.1.1 secondary

 hwtacacs-server accounting 192.168.1.1 secondary

 hwtacacs-server shared-key cipher *** 

#

aaa

authentication-scheme acs1

  authentication-mode hwtacacs local

Duplicacy of the user account (admin) on both the switch and Tacacs server.

After checking debug logs we'll find out that authentication has been done through only Tacacs server and customer configure the same user account on switch and server both ,so Customer  have to use seprate username and password for local or tacacs authentication

TAC_MESSAGE for TAC->AAA: 

UserID:849  RequestID:0x4  TemplateNO:0

Bitmap:1 0 0 0 0 0 

SourceMessage:0x7

<testing_Okha211>plz 

Apr 13 2016 17:32:09.850.4-05:13 testing_Okha211 TACACS/7/Event:

ServerMsg=username:   Echo=REPLY_FLAG_ECHO

<testing_Okha211>plz 

Apr 13 2016 17:32:09.880.1-05:13 testing_Okha211 AAA/7/DEBUG:

 AAA receive AAA_TAC_MSG_AUTHENREPLY message from TAC module.