Windows 2012 R2 - Set up RADIUS Server without AD


I have been searching and trying everything I find about setting up RADIUS on Win2012 (without AD) but I cannot get it to work. I want to use Duo with Sophos UTM. I have followed several tutorials and I can connect to the RADIUS server but authentication always fails.

This is the best tutorial I have found:

Can someone tell if there are missing steps and how to troubleshoot?

I simply had to move my network policy for the client up to the top of the list.