I have a bunch of ZD1200 and ZD3000 units at multiple sites. I am wanting to setup a Windows Server 2016 box to use NPS for radius. I am having a difficult time getting this to work. My best guess is an issue with routing/nat.
In my test lab I have a ZD behind a Cisco ASA. The ZD has a private IP but has internet access. The Radius server is behind another ASA with a private IP and has internet access. I can never get traffic all the way to the radius server from the ZD.
Hm, double NAT... what IP do you tell the ZD to use for your RADIUS server, and vice versa? You probably need routes to those IPs on the inside of both sides, and port-forward of the IP to their NAT-translated inside IPs (on both sides). Have you sniffed your wire to see if packets go out and/or ever come back (on either side)?
It is worth running packer-tracer on the ASA inside interface (on the ZD side) to the NPS ip. You can verify if all the phases are permitted (eg: UN-NAT, ACLs, NAT, IP-OPTIONS, and FLOW-CREATION), and the final message should be "ALLOW". I had seen issue without inspection map configured so running the packet-tracer can isolate the issue not on the ASA config, then you can focus on the endpoints (ie: ZD and NPS).