Secondary Authentication

hey,

we have some 3rd party radius that is performing OTP othentication for the user.

i want to have two factor authentication on my VPN GW, it knows how to handle challange from the radius server to send additional password but i dont know the implementation on the NPS server.
the process should be something like this:
1) user sent the username and password on the VPN GW
2) authentication request send to the radius server
3) the radius server authenticates the user credentials against the AD
4) the NPS will send a Access Challenge to the client for additional password  
5) the NPS will forard the authentication to a remote radius server
6) if the remote radius server returns access granteed the NPS will also send this type back to the server

thanks