First put a tag on your ZI.  Go to: Secureity Appliance/Appliance Status Click on the pencil next to "tags" and give the Z1 a tag.,   Go to: Security Appliance/Site to Site VPN Scroll down to: Organization-wide settings Click on: Add a peer   Give it a name.  Put in the public IP address of the CSR1000V.  For the private subnet put in 172.9.0.2/32.  Note that you will need to change the destination encryption domain of your CSR1000V to include the entire subnet behind the Z1.    Under availability choose the tag of your Z1 that you created above.  Fill in your pre-shared key.  Leave the "IPSec Policies" on the default setting. ... View more