on windows server have you added as client on radius the ip of controller or the ip of the EAP?
The authentcation geos through the EAP directly not to the controller.