Want to understand about pre-requisites and flow for Bigip APM browser based sslvpn with RSA smart card and token

You can process the flow anyway you like. You can have AD first, RSA second or RSA first and AD Second. You can have different logon pages per authenticator if you like. It is totally up to you. The one thing you need to keep in mind is that the AAA objects will only use

session.logon.last.password

session.logon.last.username

Seth