I think what they are saying is IPSEC tunnel is disallowed.
Especially to the outside of China.
You might, actually, get a way with within China, rolling out vManage, vSmart and vBond and test.
If traffics do not hit the Great Firewall, I think it will work.
I tried IPSEC tunnel from China, and it comes up, but never stays up for too long.