I've checked the network, all is fine here. Staring at more logs I've found the reason, but not the final solution:
It's also encryption here! In vpxa.lig I found an NFC SSL error and the message that the data encryption has failed. So basically the same issue as with vmotion where I need to disable the vmotion encryption when I want to migrate anything to this host.
I've disabled encrypted NFC in vCenter and the cold migration does now work.
The big question: Why can't this single host decrypt any encrypted vmotion or NFC traffic? And how can I solve this?