Very common thing to setup. Since you are using NPS you should have a handle on that except that depending on how you configure it each radio is a client or the controller is the client in NPS. We usually add each radio or the subnet that the radios are on for management as the client. 
Then create a connection request policy. Overview tab is a name and the rest default then the conditions tab is as follows.
The settings tab is default except for the authentication methods.
If you edit the EAP type then you can select the certificate to use.
On the VSC or SZ controller it looks like this. Create a Radius Server Connection under Services/Profiles/authentication.
Create a WLAN that uses 802.1x. The picture in this one is named cloupath but disregard as it is one I use for testing lots of different things.
You have to watch your logs on the NAP server to see what might be happening if the clients are not able to connect. If the NAP log shows nothing it might have to be enabled.
auditpol /set /subcategory:"Network Policy Server" /success:enable /failure:enable
Sometimes the local policy has issues and it can be found here to enable the NAP logging.
The success/failure setting can be found at Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> Audit Policies -> Logon/Logoff -> Audit Network Policy Server.
Then create a connection request policy. Overview tab is a name and the rest default then the conditions tab is as follows.
The settings tab is default except for the authentication methods.
If you edit the EAP type then you can select the certificate to use.
On the VSC or SZ controller it looks like this. Create a Radius Server Connection under Services/Profiles/authentication.
Create a WLAN that uses 802.1x. The picture in this one is named cloupath but disregard as it is one I use for testing lots of different things.
You have to watch your logs on the NAP server to see what might be happening if the clients are not able to connect. If the NAP log shows nothing it might have to be enabled.
auditpol /set /subcategory:"Network Policy Server" /success:enable /failure:enable
Sometimes the local policy has issues and it can be found here to enable the NAP logging.
The success/failure setting can be found at Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> Audit Policies -> Logon/Logoff -> Audit Network Policy Server.
