Hm, an hour later it succeeded:
May 17 20:40:43.000 [warn] Your server (...:9001) has not managed to confirm that its ORPort is reachable. May 17 21:00:43.000 [warn] Your server (...:9001) has not managed to confirm that its ORPort is reachable. May 17 21:20:43.000 [warn] Your server (...:9001) has not managed to confirm that its ORPort is reachable. May 17 21:38:01.000 [notice] Self-testing indicates your ORPort is reachable from the outside. Excellent. Publishing server descriptor.
Strange...
C.