Click on the pencil next to "tags" and give the Z1 a tag.,
Security Appliance/Site to Site VPN
Scroll down to:
Add a peer
Give it a name. Put in the public IP address of the CSR1000V. For the private subnet put in 22.214.171.124/32. Note that you will need to change the destination encryption domain of your CSR1000V to include the entire subnet behind the Z1. Under availability choose the tag of your Z1 that you created above. Fill in your pre-shared key. Leave the "IPSec Policies" on the default setting.