When protecting SAP landscape with SCN encryption on GUI and RFC, there are 2 parameters that can block all not-encrypted traffic: snc/only_encrypted_rfc and snc/only_encrypted_gui.
Before setting these parameters, you first want to know which interfaces and GUI connections.
Logging settings
To enable the logging, setup in SAP audit log transaction SM20 (or RSAU_CONFIG) the BUJ event for non-encrypted communication:
Next to this set RZ10 parameter snc/log_unencrypted_rfc to value 2 to also log the unencrypted RFC’s.
Warning: if you have many RFC's and start to encrypt them, this event can generate massive amounts of logging. Consider to switch on temporarily to log limited amount of time to get the first work list.
Audit log results for unencrypted RFC and GUI
Use transaction SM20 or RSAU_READ_LOG and select event BUJ.
Unencrypted RFC looks like this for ABAP to ABAP:
And for external RFC to ABAP:
In the details you can find the source IP address.
Unencrypted GUI usage looks like this:
In the Terminal Name column you can find the desktop/laptop of the user still using unencrypted GUI.