we have exchange 2013 DAG group, 2 Exchange 2013 servers, one witness server.

I cannot login to ECP on the secondary exchange server.

it is Mailbox only server, is that why?

Hello

ECP  only from CAS server Available.

Hi,

Is there any error message returned by Exchange server? How about login OWA, then redirect to RCP?
Please post more details about your question, it will be more helpful for further troubleshooting.

Please run below command to get details about ECP virtual directory:
Get-EcpVirtualDirectory | FL Identity,*URL*,*Auth*
Also, double check the status of services for Exchange.

Thanks