Freeradius Authentication not working when AP is given a reboot

Question

Dear All, I have been working on this lab. The blue part of the network represents GNS3 emulated part and green part is real part. Following are key components in network.
I am using Centos 7 as Freeradius.
I am using Cisco e4200 with DDWRT as access points. 
I am using Cisco 2950 switch as real switch connected with APs and also connected with GNS3 switches using two NICs.
I am using Cisco layer 3 switches in GNS3 
I have given the IP address of Freeradius in Access Points. It works with authentication, but when I reboot my Access Point the FreeRadius stops the authentication until I access the AP and press the apply settings button in DDWRT in order to start the authentication. Initially I thought its some problem with DDWRT but when I replaced this Cisco 2950 switch with some netgear switch authentication works really very well even If I reboot AP(It means there is no problem with DDWRT). I thought I might have some problem with Cisco 2950 switch I replaced the switch with another Cisco 3500XL series switch but the problem still exists. Authentication works but when I reboot the AP it stops the authentication and at that point I have to access the AP and press "APPLY SETTINGS" button. 
It looks like there is some problem with my Cisco Switch.  

Answer 1

If I set up the Airport in bridge mode (uncheck the
"Distribute IP Addresses" box in the Network setup
tab), the client can authenticate correctly and can
obtain an IP address from a DHCP server on my
internal network.
If I check the "Distribute IP Addresses" box, select
"Share a single address with DHCP & NAT" and the
192.168.1.1/24 address range, the client can no
longer authenticate. I haven't changed anything else
on either the Airport or the RADIUS server.
Why do you need another DHCP server when your network one is working fine?
Network traces taken on the wired (WAN) and wireless
side of the Airport show that the first few exchanges
of the EAP handshake go through fine, but the
server's reply to the client's "TLS Hello" message
are being blocked by the Airport.
If you knew the port that was used for the reply message then that could be forwarded to one address on the wireless Airport NAT network and the reply would get through to one computer. That computer should be configured with a static IP within the Airport's DHCP range to ensure it doesn't change. This may offer another level of security for the wireless network but also restricts it to one user. Again to my original question, with a Radius server authentication already required, why do you need another DHCP layer?
Is the Airport required to authenticate with the Radius server too?