Question

How to control external vendors from connecting to our internal LAN?

Network connectivity, Active Directory, Policies

I have a few vendors who are located at other plant. I would like to block their access to our internal network using their own notebook. How can I go about? We are using different IP addresses for all the buildings. As some of the clients are connected to this IP address, it's not possible for us to use ACL lists in our Layer 3 switches. Do you have any other solutions? Thanks.

The easist way would be to move them to another IP network and firewall that network from your own.

If that isn't an option then you could use IPSec to secure the traffic between your machines, and require that all traffic to your servers be encrypted.