DDoS Two-Layer Architecture

Hi ukhan20 , 

What is the problem to achieve that. 

One Arm deployment isn't a limitation for that 
you can configure L3/L4 as well as L7 DDoS protection , just you need provision AFM and choose security Turboflex profile then provision ASM or AWAF License. 
Then you can configure whatever you need. 

Even you can configure AFM DoS protection in ( Device and Protected objects level ) and use AWAF l7 DoS as well. 

Could you clarify what challenging you in this deployment.

maybe this will not be a two-tire deployment as you will have AFM DOS and AWAF DoS on the same BIGIP, I mean you will do all in the same tire or layer. 

if you want to achieve the multi-tire deployments 
you have to use two devices, one for AFM and the other one for AWAF close to DMZ or application servers.