Which VLANs must be enabled for a SNAT to perform as desired (translating only desired packets).

Enabling a SNAT for all VLANs is overly broad and unnecessary - it would also attempt SNAT processing on VLANs where no desired client traffic arrives, which is inefficient and potentially undesirable.

SNAT is applied based on where packets arrive (ingress), not where they leave (egress); enabling it only on egress VLANs would mean the BIG-IP never evaluates the packets for SNAT translation.

BIG-IP SNAT processing evaluates packets as they enter the system on a VLAN, matching source addresses against the SNAT's origin address list before deciding whether to translate. Enabling the SNAT on the ingress VLAN where the client packets arrive is what causes the BIG-IP to apply source address translation to those packets. Enabling it on egress VLANs has no effect on whether the translation occurs.

Enabling the SNAT on both ingress and egress VLANs is redundant because SNAT processing only occurs at ingress; the egress VLAN setting does not contribute to whether translation takes place.