A good alternative to two factor authentication would be something like the FortiGate Series. This is a series that consist of hardware firewalls designed to protect computer networks from abuse basically. They will reside between the network they are protecting and an external network like the internet. This FortiGate Series will span the full range of network environments, from the small office and home office to the service provider, offering cost-effective systems for any application. They can detect and eliminate damaging, content-based threats from email and Web traffic such as viruses, worms, intrusions, and inappropriate Web content in real-time without degrading network performance, which is something I would be looking for. In addition to it providing application-level protection, the FortiGate Series can deliver a full range of network-level services which include firewall, Virtual Private Network, intrusion prevention and traffic shaping in a dedicated, easily managed platform. The FortiGate series provides a NAT/route mode that will apply security features between two or more different networks and a transparent mode that applies security features at any point in a network, which is a huge plus.
A FortiGate unit will consist of a hardware box and the custom firewall software FortiOS, A separate administrator console will be used to perform system administration. This firewall can operate either alone or as part of a firewall cluster in order to provide a high availability of services. All of the different models offered in the FortiGate Series will share common software, in case you would like to add or upgrade later. The different models in this series provide for increased performance and additional protected ports.
As mentioned, FortiOS is a security-hardened, purpose-built operating system that is the software foundation of all FortiGate consolidated security platforms. FortiOS can authenticate users with a user name/password challenge using the HTTP, HTTPS or FTP protocol. FortiOS can also redirect HTTP authentication challenges to a secure HTTPS channel, which is good. An authentication challenge can be required whenever a user attempts a connection that is controlled by something like Certificates, Fortinet Single Sign-On, Identity-based security policy, and Administration access. When FortiOS receives a user’s credentials, they will be matched with a user group. If a match is found, the user will be allowed access until the system-wide authentication timeout expires.
The software FortiTokens is an alternative to two-factor authentication with certificates, or a third party one-time password system. FortiTokens are small random key generators that provide a six digit key to accompany username and password when logging on. This can be configured for a user or administrator account, which will have the logon prompt display the usual username and password fields and on successful entry of that information prompts with an additional field for the six-digit token or key.
Each FortiToken device’s serial number must be registered on the FortiGate unit and verified with FortiGuard servers before it can be used to logon, this is important. The FortiToken information in the FortiGate unit will always be encrypted. If a token is lost or stolen, an administrator can either disable or delete it to prevent unauthorized use, which is very helpful. A FortiAuthenticator server can easily manage large numbers of FortiTokens for FortiOS if you have the need so all in all these sounds like a great alternative.

References
Fortinet (2012). FortiOS 4.0 Software. Retrieved February 5, 2012, http://www.fortinet.com/doc/FortiOS_BRO.pdf
Fortinet (2012). Security Solutions. Retrieved February 5, 2012, http://www.fortinet.com/solutions/enterprise.html