diff --git a/api/src/com/cloud/network/NetworkModel.java b/api/src/com/cloud/network/NetworkModel.java
index f6555db565e..574160d2c64 100644
--- a/api/src/com/cloud/network/NetworkModel.java
+++ b/api/src/com/cloud/network/NetworkModel.java
@@ -90,6 +90,8 @@ public interface NetworkModel {
 
     boolean areServicesSupportedByNetworkOffering(long networkOfferingId, Service... services);
 
+    Network getNetworkWithSGWithFreeIPs(Long zoneId);
+
     Network getNetworkWithSecurityGroupEnabled(Long zoneId);
 
     String getIpOfNetworkElementInVirtualNetwork(long accountId, long dataCenterId);
@@ -273,4 +275,4 @@ public interface NetworkModel {
     boolean isNetworkReadyForGc(long networkId);
 
     boolean getNetworkEgressDefaultPolicy(Long networkId);
-}
\ No newline at end of file
+}
diff --git a/server/src/com/cloud/network/NetworkModelImpl.java b/server/src/com/cloud/network/NetworkModelImpl.java
index 7b4b2bebdb2..3d2b1333ef9 100755
--- a/server/src/com/cloud/network/NetworkModelImpl.java
+++ b/server/src/com/cloud/network/NetworkModelImpl.java
@@ -736,6 +736,31 @@ public class NetworkModelImpl extends ManagerBase implements NetworkModel {
         return networks.get(0);
     }
 
+    @Override
+    public NetworkVO getNetworkWithSGWithFreeIPs(Long zoneId) {
+        List<NetworkVO> networks = _networksDao.listByZoneSecurityGroup(zoneId);
+        if (networks == null || networks.isEmpty()) {
+            return null;
+        }
+        NetworkVO ret_network = null;
+        for (NetworkVO nw : networks) {
+            List<VlanVO> vlans = _vlanDao.listVlansByNetworkId(nw.getId());
+            for (VlanVO vlan : vlans) {
+                if (_ipAddressDao.countFreeIpsInVlan(vlan.getId()) > 0) {
+                    ret_network = nw;
+                    break;
+                }
+            }
+            if (ret_network != null) {
+                break;
+            }
+        }
+        if (ret_network == null) {
+            s_logger.debug("Can not find network with security group enabled with free IPs");
+        }
+        return ret_network;
+    }
+
     @Override
     public NetworkVO getNetworkWithSecurityGroupEnabled(Long zoneId) {
         List<NetworkVO> networks = _networksDao.listByZoneSecurityGroup(zoneId);
diff --git a/server/src/com/cloud/vm/UserVmManagerImpl.java b/server/src/com/cloud/vm/UserVmManagerImpl.java
index b3a5054acf8..4f0c5f409de 100755
--- a/server/src/com/cloud/vm/UserVmManagerImpl.java
+++ b/server/src/com/cloud/vm/UserVmManagerImpl.java
@@ -2358,7 +2358,7 @@ public class UserVmManagerImpl extends ManagerBase implements UserVmManager, Vir
 
         // If no network is specified, find system security group enabled network
         if (networkIdList == null || networkIdList.isEmpty()) {
-            Network networkWithSecurityGroup = _networkModel.getNetworkWithSecurityGroupEnabled(zone.getId());
+            Network networkWithSecurityGroup = _networkModel.getNetworkWithSGWithFreeIPs(zone.getId());
             if (networkWithSecurityGroup == null) {
                 throw new InvalidParameterValueException("No network with security enabled is found in zone id=" + zone.getId());
             }
diff --git a/server/test/com/cloud/network/MockNetworkModelImpl.java b/server/test/com/cloud/network/MockNetworkModelImpl.java
index 6c9e597b9f3..14c42f302e9 100644
--- a/server/test/com/cloud/network/MockNetworkModelImpl.java
+++ b/server/test/com/cloud/network/MockNetworkModelImpl.java
@@ -227,6 +227,15 @@ public class MockNetworkModelImpl extends ManagerBase implements NetworkModel {
         return false;
     }
 
+    /* (non-Javadoc)
+     * @see com.cloud.network.NetworkModel#getNetworkWithSGWithFreeIPs(java.lang.Long)
+     */
+    @Override
+    public NetworkVO getNetworkWithSGWithFreeIPs(Long zoneId) {
+        // TODO Auto-generated method stub
+        return null;
+    }
+
     /* (non-Javadoc)
      * @see com.cloud.network.NetworkModel#getNetworkWithSecurityGroupEnabled(java.lang.Long)
      */
diff --git a/server/test/com/cloud/vpc/MockNetworkModelImpl.java b/server/test/com/cloud/vpc/MockNetworkModelImpl.java
index 67ab8e875cb..13646446288 100644
--- a/server/test/com/cloud/vpc/MockNetworkModelImpl.java
+++ b/server/test/com/cloud/vpc/MockNetworkModelImpl.java
@@ -238,6 +238,15 @@ public class MockNetworkModelImpl extends ManagerBase implements NetworkModel {
         return (_ntwkOfferingSrvcDao.areServicesSupportedByNetworkOffering(networkOfferingId, services));
     }
 
+    /* (non-Javadoc)
+     * @see com.cloud.network.NetworkModel#getNetworkWithSGWithFreeIPs(java.lang.Long)
+     */
+    @Override
+    public NetworkVO getNetworkWithSGWithFreeIPs(Long zoneId) {
+        // TODO Auto-generated method stub
+        return null;
+    }
+
     /* (non-Javadoc)
      * @see com.cloud.network.NetworkModel#getNetworkWithSecurityGroupEnabled(java.lang.Long)
      */