F5 apm or ltm work as a proxy which has 2 factors authentication

I suppose the bigger question is which 2-factor auth are you trying to implement? APM is the product that handles most multi-factor auth functions.

rsa . I don't know how to set the proxy

Start with this:

https://support.f5.com/kb/en-us/products/big-ip_apm/manuals/product/apm-authentication-single-sign-on-11-6-0/6.htmlconceptid

Tried to set ltm vip as proxy today via irule . It can work but when I assioate an access profile to this vip, the logon page doesn't show when brower access internet via this proxy

SWG sounds what you want: https://f5.com/products/modules/secure-web-gateway

as it can also check health and such, i assume it can also show a login where you can do two factor auth. although im not really see the situation where a proxy would require 2factor, feels rather harsh.