Which VLANs must be enabled for a SNAT to perform as desired (translating only desired packets)?

Enabling SNAT on all VLANs would translate all traffic, which might not be desired and could lead to unintended behavior for non-targeted traffic.

Enabling SNAT only on VLANs where packets leave would mean the incoming packets are not matched by the SNAT object for translation upon arrival.

To correctly perform source IP address translation for specific incoming traffic, the SNAT object must be explicitly associated with and enabled on the VLANs where client requests initially arrive at the BIG-IP system. This configuration allows the SNAT to process only the packets originating from those specified VLANs, ensuring targeted translation.

While packets eventually leave a VLAN, the initial condition for a SNAT to intercept and translate a packet is its arrival on a VLAN where it is enabled.