Core issue
This problem was first found in CiscoSecure ACS for Windows version 3.3.1 and is documented in Cisco bug ID CSCef47975.
When CiscoSecure ACS for Windows version 3.3.1 is configured as a RADIUS proxy for another RADIUS server, fields are corrupted in the RADIUS proxy message sent by the CiscoSecure ACS to the other RADIUS server. Because of this, users fail authentication to the other RADIUS server.
Resolution
This bug is fixed in CiscoSecure ACS for Windows version 3.3.2. In order to download CiscoSecure ACS for Windows version 3.3.2, open a service request with the Cisco Technical Assistance Center (TAC).