Radius client can not communicate with radius server aka (Userman) when general masquarading rule is applied.
exclude 127.0.0.1 from masquerading & use 127.0.0.1 as Radius client & User manager IP.
Use this code instead
/ip/firewall/nat/add chain=srcnat action=masquerade src-address=!127.0.0.1 log=no
or you can also define masquerading rule separately for each subnet for added security.
Took me 2 hours to solve this issue. posting here to help others.