Securing BIG-IP MGMT interfaces with RSA two-factor auth

I have a customer requirement to support two-factor authentication on the BIG-IP MGMT interfaces, both HTTPS and SSH. The authentication source is RSA. I understand that with RSA, remote authentication is configured to use RADIUS, but how do we transport the token value to the RSA server, and how do we signal to the user that the token needs to be included?