diff --git a/pkg/compute/models/guest_actions.go b/pkg/compute/models/guest_actions.go
index 19f0397e3e..8af1fb8dfa 100644
--- a/pkg/compute/models/guest_actions.go
+++ b/pkg/compute/models/guest_actions.go
@@ -23,6 +23,7 @@ import (
 	"yunion.io/x/onecloud/pkg/util/seclib2"
 
 	"time"
+
 	"yunion.io/x/jsonutils"
 	"yunion.io/x/log"
 	"yunion.io/x/onecloud/pkg/util/billing"
@@ -643,24 +644,30 @@ func (self *SGuest) PerformAddSecgroup(ctx context.Context, userCred mcclient.To
 		return nil, httperrors.NewInputParameterError("Cannot assign security rules in status %s", self.Status)
 	}
 
-	secgrpV := validators.NewModelIdOrNameValidator("secgrp", "secgroup", userCred.GetProjectId())
-	if err := secgrpV.Validate(data.(*jsonutils.JSONDict)); err != nil {
-		return nil, err
-	}
-
 	maxCount := self.GetDriver().GetMaxSecurityGroupCount()
 	if maxCount == 0 {
 		return nil, httperrors.NewUnsupportOperationError("Cannot assign security group for this guest %s", self.Name)
 	}
 
+	secgrps := []string{}
+	if err := data.Unmarshal(&secgrps, "secgrps"); err != nil {
+		return nil, httperrors.NewInputParameterError(err.Error())
+	}
+
 	secgroups := self.GetSecgroups()
-	if len(secgroups) >= maxCount {
+	if len(secgroups)+len(secgrps) >= maxCount {
 		return nil, httperrors.NewUnsupportOperationError("guest %s band to up to %d security groups", self.Name, maxCount)
 	}
 
-	secgroup := secgrpV.Model.(*SSecurityGroup)
-	if _, err := GuestsecgroupManager.newGuestSecgroup(ctx, userCred, self, secgroup); err != nil {
-		return nil, httperrors.NewInputParameterError(err.Error())
+	for _, _secgrp := range secgrps {
+		secgrp, err := SecurityGroupManager.FetchByIdOrName(userCred, _secgrp)
+		if err != nil {
+			return nil, httperrors.NewInputParameterError(err.Error())
+		}
+		secgroup := secgrp.(*SSecurityGroup)
+		if _, err := GuestsecgroupManager.newGuestSecgroup(ctx, userCred, self, secgroup); err != nil {
+			return nil, httperrors.NewInputParameterError(err.Error())
+		}
 	}
 	return nil, self.StartSyncTask(ctx, userCred, true, "")
 }