> +- entering group authenticate {...}
> [eap] EAP Identity
> [eap] processing type md5
> rlm_eap_md5: Issuing Challenge
> ++[eap] returns handled
> Sending Access-Challenge of id 249 to 196.0.4.18 port 1812

You're still have EAP-MD5 as default EAP method.

Look thoroughly into eap.conf. There is default_eap_type setting in eap {...} section. This is default outer EAP method. You should set it to ttls. There is default_eap_type setting in ttls {...} subsection of eap {...} section. This is default inner EAP method for EAP-TTLS. You should set it to gtc.

Restart freeradius after the change. You should see something like this when processing first Access-Request:

[eap] EAP Identity
[eap] processing type tls
[tls] Initiate
[tls] Start returned 1