ION sends authentication requests using CHAP after overriding the AAA TACACS+ configuration to use PAP

• Element TACACS+ config overridden to use PAP, but sends CHAP 
• This causes authentication failure.
• TACACS+ Server (Cisco ISE in this case) reports "Authentication failure" and "Root Cause Subject not found in the applicable identity store(s)"

• Prisma SD-WAN
• ION devices
• 6.5.1-b5 onwards
• TACACS+ authentication
• Cisco ISE TACACS+

Defect in the config update for TACACS+ 

1. Workaround - Delete the AAA TACACS+ profile and create a new one with PAP as the authentication protocol.
2. The issue is fixed in 6.6.1 software version.

• "debug logs dump auth" is used to view authd logs
• Add TACACS+ Profile