An option that I've had unofficially recommended to me in these sort of sitations is to try and maintain separation betsween the VPN component and the authentication component. What happens is that the token-based authentication server is located behind the VPN concentrator, and token-based authentication occurds AFTER the VPN has been established (usually by means of group files etc)
The advantage of this approach is that there is no dependency between your VPN RAS solution, and your token solution. If you want to replace one, you can do so without affecting the other.
Personally, I have seen safeword tokens used both in conjunction with the VPN concentrator itself, and also installed on a web site that can only be reached through a VPN RAS tunnel. They seem to work okay, although I'm reserving judgement on security to do with the tokens themselves.
