To add to what Nick said, the CSR1000V is now supported as an SSLVPN (AnyConnect) headend in XE3.12 and later. If you've configured SSLVPN on classic IOS or on ASA, the configuration is a bit different. The new configuration method has been affectionately know as "FlexSSL" as it is a hybrid of FlexVPN and SSLVPN. Here's the configuration guide: http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_sslvpn/configuration/xe-3s/sec-conn-sslvpn-xe-3s-book.html
The following document contains examples of how to deploy and configure
the CSR1000V within Amazon Web Services (AWS) in a DMVPN configuration
as well as details on how to setup VPC Gateway Redundancy.