Are brute force attacks on public facing interface of internet router normal? Enterprise Router (Cisco) with all hardening done. What can be done to stop this behavior?
Yes. This is why you need to harden any exposed service. Additionally, you might want to monitor potential attack vectors for recurring attacks so you can lock them out completely.
If you haven't been seeing these attacks nowadays you haven't been looking.
To stop these attacks you will have to either stop the attacker (good luck with that) or filter out the traffic when or before it hits the router. We run the WAN link through a switch and filter out known attackers by ACLs.