How to prevent vicious login attempt from Internet to Firewall

Hi Rengar,
The analysis is performed from the following aspects:
Separation of functions: Separate deployment of the service traffic firewall and firewall for preventing Internet attacks is effective. The function of the external firewall is similar to that of the anti-DDoS device.
2) VTY: VTY is a concept closer to the control plane. Before the authentication or authorization fails, all failed logins do not occupy the VTY.
3) Hidden: It is difficult to determine whether the public IP address is dialed during remote debugging. Generally, the SSL VPN is connected to the device, and the private IP address is used for configuration and commissioning. Therefore, the TCP/UDP ports that need to be disabled for public IP addresses must be disabled.
4) Feature: The ASA provides a feature for the same user to lock the password after the number of failed attempts to prevent brute force cracking.
I hope it helps!