Deutsche Telekom CompanyFlex SIP-Trunk: registration, MediaSec and capacity boundaries

Bind 1TR119 to the current CompanyFlex handoff

Deutsche Telekom publishes 1TR119 specifically for the CompanyFlex SIP-trunking interface. It is a protocol boundary, not a copy-ready account template. Record the assigned registration identity, domain, route targets, credential owner, number inventory, contracted parallel calls, portal roles and support terms from the current handoff.

Preserve DNS resolution, transport, REGISTER, Contact, expiry, refresh and response evidence for the exact PBX. Registration success proves only that transaction; it does not establish identity authorization, inbound normalization, media, failover or emergency behavior.

Keep number identity and routing evidence together

CompanyFlex supports individual numbers, DDI ranges, number transfer and shared multi-site resources. Those ordering capabilities do not show which identity the network delivered or accepted on one call. Keep the assigned inventory and port state with Request-URI, From, P-Preferred-Identity or P-Asserted-Identity and the PBX route that matched.

Do not substitute a DID, pilot, registration number or legacy DeutschlandLAN field because the labels look similar. The current provider record and an authorized wire capture must establish each role.

Treat MediaSec as a bounded hop

1TR119 v1.13.0 documents MediaSec negotiation on the CompanyFlex PBX interface and explicitly scopes encryption between the IP-PBX and registration server. That is not proof that the far endpoint, PSTN segment, recording system or downstream service is protected.

Retain certificate validation, TLS session, required security headers, selected media mechanism, offer and answer, RTP profile and observed packet path. A saved setting or successful secure registration does not prove that media used the expected protection on a call.

Accept codecs and fax on observed sessions

The specification requires the PBX to support G.711 A-law, recommends G.722 and recommends 20 ms packetization. Other listed codecs depend on negotiation by every involved element. Preserve both SDP bodies, selected payloads, packetization, RTP endpoints and decoded DTMF evidence rather than reporting the interface list as the call result.

For fax, 1TR119 describes G.711 support and passive T.38 when both NGN SIP-trunk endpoints agree. It does not support encrypted T.38. Test the exact gateways, fallback behavior, destination and page result under an approved plan.

Separate calls, access resilience and service operations

The product includes a small number of parallel calls and lets more be ordered, while multiple sites can share the pool. Contracted calls, active calls, call starts, bursts, bandwidth and PBX or SBC resources are different limits. Use the order for entitlement and an approved load plan for measured behavior.

Mobile access backup, a second access path and a separately configured redundant trunk are distinct continuity layers. Record portal roles, monitoring, support tier and a bounded new-call failure exercise. Emergency treatment and messaging remain unresolved until account-specific provider records establish them.

Diagnose 403 at the method and header that failed

For Asterisk PJSIP, use the focused 403 diagnostic to keep a rejected REGISTER Contact separate from a rejected INVITE identity. The current handoff and 1TR119 govern CompanyFlex values; Asterisk's registration contact_user and endpoint or channel identity controls are not interchangeable.