He is accessing CA server running locally on ASA in order to enroll. But he couldn't get authenticated against CA user database (LOCAL AAA method is used instead). That's why OTP doesn't work for him.

Hi,if you do 'debug http 255', you'll see something like that:HTTP: file not found: CSCOCA /enroll.html

No (PAT is not supported with the fixup protocol rtsp) and No (you will need NAT to map the end of GRE tunnel; it will also compromise your security – pix doesn’t look inside tunnel’s payload).