We have a number of identically configured MT hotspots - all but one work fine with our RADIUS server. The one that doesn't work is NATed through another MT on our network.

I seem to remember there was a work around for this but I can't remember what it was. Can anyone help?

I had the same problem on one of my systems. I checked the logs of the radius server and saw the ip that was being rejected. Then I knew what IP I was coming from. Set the secret in the radius server with the ip and all was good..