Cisco IP Fragments ACL strange behavior

Question

I am testing following ACL on Cisco 3850 L3 switch :

C3850#show ip access-lists 101
Extended IP access list 101
    10 deny ip any any fragments
    20 permit ip any any (268 matches)

I applied access list on ISP side interface in:

interface TenGigabitEthernet1/1/1
 description ISP
 no switchport
 ip address 61.XX.XX.158 255.255.255.252
 ip access-group 101 in

From remote host, I am doing ping with -s 1500 big packet size so it will get fragments, and the ACL will drop them. It looks like it works, too; I am not getting ping reply back.

To make sure routing dropping packet or not, I ran tcpdump on one of HOST machines, and I can see ICMP packets coming in. It's strange why the router is not dropping them at inbound ?

The ACL hit count is zero for fragments:

C3850#show ip access-lists 101
Extended IP access list 101
    10 deny ip any any fragments
    20 permit ip any any (4006 matches)

Answer 1

Apparently, this will treat an initial fragment the same as a non-fragment. The initial fragment will get through, but subsequent fragments in the same packet will be dropped.

See Access Control Lists and IP Fragments:

ACL Rules Flowchart

The following flowchart illustrates the ACL rules when non-fragments, initial fragments, and non-initial fragments are checked against the ACL.

Note: The non-initial fragments themselves contain only Layer 3, never Layer 4 information, although the ACL may contain both Layer 3 and Layer 4 information.