Defending against ssh attacks

Hi all: We proxy ssh traffic to one of our SLES servers for
ssh tunneling purposes. We have disabled password
authentication and rely solely on rsa key authentication.
However, we still have a flood of ssh password guessing
traffic which I want to block.

One option I am looking at is to abandon the ssh proxy and
route all ssh traffic directly to the SLES box. Then on the
SLES box config iptables to allow only so many ssh login
attempts per minute per ip address. Alternately iptables
could be setup to permanently block ip addresses after so
many failures.

My question is this: Can a similar technique be employed on
our BM 3.9 server? I really don't want to have to screw
around with multiple firewalls!

Thanks, Chris.