You are making an assumption in your addendum that uggedal does not understand how tunneling works. All he did was ask how they handle security not "how does tunneling work?"
I've actually used http://www.tinc-vpn.org/ to tunnel Tokyo Tyrant between data centers. It was a bit flaky at times though, so hardware Cisco tunneling looks like a good option if you have access to the firewall in your environment (eliminates all cloud providers).