Restricting VPN Access to Specific Devices

We have a client that is requiring us to restrict VPN access to specific devices. We originally thought that perhaps client certificates would be the way to go but we don't want to give up the security provided by the Fortitokens and it seems that you can't assign a Fortitoken to a PKI user or assign a client certificate to a VPN user. Perhaps this isn't the right way to go at all. Any suggestions? Perhaps MAC address filtering? Does that work for VPN connections if the firewall is handing out IP addresses? The only guides I see for setting up MAC filtering are specific to wireless connections.

Thanks!