Is tacacs supported via the mgmt interface on the CSS switches? This is what I have configured and cannot get tacacs to work from the CSS.
virtual authentication primary tacacs
virtual authentication secondary local
tacacs-server 172.31.4.120 49 20 test primary frequency 10
The static route is in place to the tacacs server(s) from the CSS on the Mgmt interface.