Sorry for maybe asking some stupid questions, but after reading I don't get the full overview.
What is the IP of your Instant AP?
What is the IAP virtual controller IP? 192.168.20.5?
What is the IP address of your NPS server?
Did you put in that IP address as the RADIUS server in your Instant AP?
Have you reloaded/restarted the NPS service after you added the IAP VC address as RADIUS client?
Can you screenshot the message: "Authentication Server SaxoAD with ip 192.168.20.5 is down"? Where is that displayed? I would expect the IP address of your NPS server.