I think that between the radius server and your access point there is a NAT router. If so you must associate the shared secred in the access point list with the IP address of the NAT router. This is because the access point contacts the radius server with a masqerade IP.
Regards
Fulvio
