For anyone else having this kind of problem, I would ask if you have type 6 or type 7 passwords for your radius servers in the 9800CL config?
For years I've been seeing a bug in IOS-XE that you only see when you turn on FIPS and have type 6 radius passwords for something other than ISE, in that the device just stops talking to the radius server, no errors (other than "AAA Server Down" in the 9800CL when trying to authenticate users, and no radius traffic being seen in a capture upstream from a switch), it just doesn't do anything.
So if you're getting (AAA Server Down), and are sure your credentials and ACLs are fine all the way to the server, maybe try removing "password encryption aes" and then remove the radius servers with the type 6 passwords, and re-add them, (now a type 7), and see if your AAA Server Down problem doesn't go right away.
I've seen this on switches running IOS-XE and now the 9800CL. Strangely enough type 6 passwords work just fine with ISE, just nothing else (Forescout, NPS).
I think a lot of people stumble into the solution and don't realize what fixed it, in switches you turn FIPS on in the CLI, in the 9800CL it's only seen in the GUI. I bet most people won't ever see this bug unless you have to turn FIPS on or accidently turn it on.
Cisco seems to acknowledge this now, but no one is associating this with the problems it's causing. This post is so someone looking can go straight to the solution.
https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/17-17/config-guide/b_wl_17_17_cg/m-fips.html
"FIPS is not compatible with level-6 encrypted passwords. Additionally, 802.1X authentications will fail if the RADIUS shared secret uses a type-6 encryption key."
