Ok, thanks for the info!
The 30 seconds might have been a mistake on my side, I haven't watched the time, but ping reported ~30 answers so I assumed 30s (at the default 1s/ping).
In my case, it would be ok if there were a per VM option to choose between "shortly disable firewall, <1s downtime"...