1.create an authentication vserver and bind one SSL server certificate to it

add authentication vserver radiusLDAP SSL 0.0.0.0
bind ssl vserver radiusLDAP -certkeyName <your_certKey>

2.create advanced radius policy. 

add authentication radiusAction radius-act -serverIP <your_radiusIP> -serverPort <port> -radKey <your_radiusKey>
add authentication Policy radius-pol -rule true -action radius-act 

3.create policy label for radius. Specify to use the second password for radius authentication

add authentication loginSchema DualAuth-Radius -authenticationSchema "/nsconfig/loginschema/LoginSchema/DualAuth.xml" -passwdExpression "AAA.LOGIN.VALUE(\"passwd1\")"
add authentication policylabel DualAuth-Radius-pol-label -loginSchema DualAuth-Radius

4.create advanced LDAP policy

add authentication ldapAction LDAP_act -serverIP <your_LDAP> -ldapBase "dc=<your_domain>" -ldapBindDn <your_DN> -ldapBindDnPassword <your_password> -ldapLoginName sAMAccountName -groupAttrName memberOf
add authentication Policy ldap-adv-pol -rule true -action LDAP_act 

5.create policy label for LDAP. Specify to use the first password for LDAP authentication and enable SSO

add authentication loginSchema NoSchema-LDAP -authenticationSchema noschema -passwdExpression AAA.LOGIN.PASSWORD -SSOCredentials YES
add authentication policylabel NoSchema-LDAP-pol-label -loginSchema NoSchema-LDAP

6.bind LDAP policy to policy label

bind authentication policylabel NoSchema-LDAP-pol-label -policyName ldap-adv-pol -priority 100 -gotoPriorityExpression NEXT

7.bind Radius policy to policy label and specify LDAP as next factor

bind authentication policylabel DualAuth-Radius-pol-label -policyName radius-pol -priority 100 -gotoPriorityExpression NEXT -nextFactor NoSchema-LDAP-pol-label

8.Bind No_auth policy as start point and the next factor is Radius

add authentication Policy NoAuth-pol -rule true -action NO_AUTHN
bind authentication vserver radiusLDAP -policy NoAuth-pol -priority 100 -nextFactor DualAuth-Radius-pol-label -gotoPriorityExpression NEXT

9.create an authentication profile and bind the authentication vserver to it

add authentication authnProfile aaa-prof -authnVsName radiusLDAP

10.set the authentication profile to your gateway virtual server.

set vpn vserver <vserver_name> -authnProfile aaa-prof

11.After binding the above profile, your gateway will start to use it immediately. Your previous authentication policies bound to the gateway virtual server will not take effect any more . And you don't need to unbind your previous authentication polices.
If you want to roll back to your previous config, you just need to unset the profile.

unset vpn vserver <vserver_name> -authnProfile

This article describes how to implement RADIUS authentication followed by LDAP. At the same time, to align with standard practices, users are required to enter their LDAP password first.