I don’t understand why you specify /21.
The CIDR notation (Classless Inter-Domain Routing) 172.18.184.106/21 and 172.18.184.107/21 are network address and not host IP address and the problem is that they rappresent the same subnet:
Infact the binary notation of the netmask is:
1111111.1111111.11111000.00000000 (21 ones)
therefore when FreeRADIUS applies the logical AND operation the last byte of both the networks is zero. In other words you have:
172.18.184.106/21 = 172.18.184.107/21 = 172.18.184.0/21
To verify these things you could use the commands:
ipcalc -n 172.18.184.106/21
ipcalc -n 172.18.184.107/21
the output is for both:
This means that FreeRadius uses the last shared secret you specified.
To solve the issue you have to specify the IP address of the Access Points as 172.18.184.106 and 172.18.184.107 or if you want use CIDR notation 172.18.184.106/32 and 172.18.184.107/32.