Configuring 2FA for BigIP management interface using RSA

The Radius configuration will likely depend on the version of Authentication Manager you are running. I suggest you check the RSA community site or contact your RSA SE for that part. If you do go the RSA Radius route then remember that all Radius authenticated users will get the same access to Big-IP unless you also implement Remote Role Groups which I presume would be based on a returned Radius attribute.

I suggest after you enable Radius on AM that you try adding a Radius attribute to the user or group and then capture with Wireshark to see exactly how the attribute is passed. The RSA community site tells you how to decrypt Radius use the Secret key. Unfortunately I have only done Remote Role Groups with Tacacs therefore I cannot provide you a specific Radius example.