WAX220 WPA2-Enterprise help with VLAN?

I have 3 WiFi networks configured like so:

ESSID_1 - 5gz only - WPA2-Personal - VLAN 101

ESSID_2 - 2.4ghz only - WPA2-Personal - VLAN 107

ESSID_3 - 2.4ghz and 5ghz - WPA2-Personal + fast roaming enabled - VLAN 102

The management VLAN is set to VLAN 101.

On my OPNsense router, the networks I've configured for each VLAN are as follows:

VLAN 101 - 192.168.101.0/24

VLAN 107 - 192.168.107.0/24

VLAN 102 - 192.168.102.0/24

My WAX220 is connected physically to a port on the OPNsense firewall that has its interface configured with the 3 VLANs only. No untagged traffic should be passed on this interface.

In this configuration, everything works as expected. Clients connected to either of the 3 networks are assigned DHCP from the OPNsense router on the correct ranges.

Then, I tried setting ESSID_2 to WPA2-Enterprise with the following configuration:

Group Key Interval - 3600

Radius Server - 192.168.101.1 (FreeRADIUS running on the OPNsense firewall)

Radius Port - 1812

Radius Secret - [triple checked for correctness]

In this configuration, I'm unable to get any clients to connect. They fail by being unable to complete the 4-way handshake.

I suspect the issue is that the WAX220 is not able to reach the Radius server running on the OPNsense firewall.

Steps I tried to troubleshoot this:

I configured radius to log as much as possible, including successful and failed login attempts, and tried connecting from multiple clients. In every case, nothing was logged by the radius server.

I downloaded the logs from the WAX220, but these are only kernel dmesg and nothing stood out to me here indicating why the WAX220 presumably does not talk to my radius server.

I made sure there are no filter rules in place that could prevent the WAX220 from communicating with the radius server on my OPNsense firewall.

I did a ping test from the diagnostics page of the WAX220, and confirmed that it is able to reach the firewall.

I used tcpdump on the vlan bridges, the individual vlan interfaces, the untagged physical interfaces to see if anything at all was being sent from the WAX220 to my radius server, and there was no radius traffic at all.

I tried all of the above tests with the radius server set to 192.168.107.1 (it listens there too, as it listens on every vlan)

I tried all of the above tests with WPA3-Enterprise as well.

Steps I did not try (yet):

WPA2-Enterprise without VLANs on the wifi networks nor a management VLAN configured. (i.e. the stock configuration for the WAX220).

Could there be a bug with 802.1X on the WAX220 when using VLANs in this way? It seems the WAX220 does not even attempt to contact the radius server, or perhaps it is trying to send these packets untagged when it should be sending them over what I presume is the configured management VLAN?