This sounds quite a bit like what has already been reported here (please compare if I’m right or wrong):
which lead to an opened bug 49283
TL;DR: The “Allow network access” attribute works together with MSCHAP authentication as of 4.4.0. radtest uses PAP by default. The current issue as I see it, is that while PEAP-MSCHAP is OK for wireless networks, PAP is still used on many switches for wired 802.1x.
If you want to fully test a PEAP-MSCHAPv2 and other methods than with the builtin tool radtest or univention-radius-check-access, I suggest reading Alan Dekok’s page about the usage of eapol_test: http://deployingradius.com/scripts/eapol_test/
(Alan Dekok is the co-founder of the FreeRADIUS project and still one of its main developers to this day