If you ping FROM the router console then the source of the packet is the router's outside IP address and therefore doesn't match your crypto access-list, and therefore doesn't get encrypted. If you source the ping packet from the inside interface of the router, then this will match the ACL and everything will work.
Similarly, you need to have the router source all its Radius packets from the inside interface so it will get encrypted. Use the command:
ip radius source-interface
You'll need to change your Radius server and add the NAS's in with the inside IP address rather than the outside.
