Hi Webabc123,
I would recommend to use SMS PASSCODE with Cisco AnyConnect. SMS PASSCODE Works with traditional IPSEC VPN, the SSL VPN and Cisco AnyConnect. You can see an example here: http://player.vimeo.com/video/100710625
SMS PASSCODE can make traditional MFA and provide a session specific token, that cannot be used outside the session. Further more is SMS PASSCODE offering geo fencing.
SMS PASSCODE can deliver the token by ordinary sms, flash sms, app based text message, voice call back, yubico token, OATH hardware token, soft token like Google authenticator or Microsoft authenticator.
You can have a mixed environment with SMS PASSCODE and RSA tokens.
The administration of a policy driven system like SMS PASSCODE will provide a huge cost saving compared to administer a hardware token solution.