OK Here is what you will want in your Config.
Under your IP Access-List Policies you will want the following. (The IPs I used are OpenDNS Anycast, just adjust to match your websense, remember everything is top down flow)
ip access-list extended DNS-ACL
remark DNS_Policy
permit udp any host 208.67.220.220 eq domain log
permit udp any host 208.67.222.222 eq domain log
deny udp any any eq domain log
Now in your Policy Class for your Private Zone, normally this is just called private. you will add your ACL Match Line.
Likely under the header "ip policy-class Private"
nat source list DNS-ACL interface eth 0/1 overload policy Public
Make sure This Line is above your all out, if you happen to use an All Out which we find all the time and that is how you wish to operate. You do not require the Public at the end of that line, I just declare when I am passing traffic to the Public Policy.
Let me know if you have any issues or need more help. If you can post your config with sensitive details scrubbed or changed is fine.
Just for those who are curious how this works.
We have the ACL (access list) We are saying if traffic from anyone that matches the packets to UDP 53 (DNS) to host x.x.x.x (in my example above it is either 208.67.220.220 or 208.67.222.222) to Permit the traffic.
Then the last line if the above two are not matched deny the traffic, so the DNS will be dropped and not allowed.
When then set this Policy in your Private Class before your Any Out. So the traffic is matched before your Any out and will either be allowed or denied. Doesn't matter that you have an any because we have denied it before those rules are matched.
Most routers operate in a First match use configuration. If you match the policy that is what we do and we look no further. Makes the logic process easy.
Hope I helped
-John
