NAT and Enabled On

I see odd behaviour on VE v11 and VE v12 code also. Traffic initiated from originating host(H1-the host who's address will be NATed) to the other host(H2) always goes thru regardless if all vlans are on disabled list(or no vlans are on enabled list). However traffic initiated from the other host(H2) is controlled by whether its vlan is on the disabled list(or excluded from enable list). I tried rebooting and that did not help. TCP dumps also show traffic passing thru the LTM from the originating host(H1) to H2.

Can someone confirm that this is expected behaviour? If this isn't - how would it work? Which vlan(s) need to go on enabled list for a NAT that only has an internal and external interface?