diff --git a/pkg/compute/guestdrivers/baremetals.go b/pkg/compute/guestdrivers/baremetals.go
index feaad43310..bb4eb12d77 100644
--- a/pkg/compute/guestdrivers/baremetals.go
+++ b/pkg/compute/guestdrivers/baremetals.go
@@ -97,7 +97,7 @@ func (self *SBaremetalGuestDriver) ValidateResizeDisk(guest *models.SGuest, disk
 }
 
 func (self *SBaremetalGuestDriver) GetNamedNetworkConfiguration(guest *models.SGuest, userCred mcclient.TokenCredential, host *models.SHost, netConfig *models.SNetworkConfig) (*models.SNetwork, string, int8, models.IPAddlocationDirection) {
-	netif, net := host.GetNetinterfaceWithNetworkAndCredential(netConfig.Network, userCred, netConfig.Reserved)
+	netif, net := host.GetNetinterfaceWithIdAndCredential(netConfig.Network, userCred, netConfig.Reserved)
 	if netif != nil {
 		return net, netif.Mac, netif.Index, models.IPAllocationStepup
 	}
diff --git a/pkg/compute/models/baremetalagents.go b/pkg/compute/models/baremetalagents.go
index 0a48d57e4f..65fcf1c30b 100644
--- a/pkg/compute/models/baremetalagents.go
+++ b/pkg/compute/models/baremetalagents.go
@@ -17,6 +17,12 @@ const (
 	BAREMETAL_AGENT_OFFLINE  = "offline"
 )
 
+const (
+	AgentTypeBaremetal = "baremetal"
+	AgentTypeEsxi      = "esxiagent"
+	AgentTypeDefault   = AgentTypeBaremetal
+)
+
 type SBaremetalagentManager struct {
 	db.SStandaloneResourceBaseManager
 }
@@ -79,14 +85,6 @@ func (self *SBaremetalagent) ValidateUpdateData(ctx context.Context, userCred mc
 			return nil, httperrors.NewConflictError("Conflict manager_uri %s", mangerUri)
 		}
 	}
-	accessIp, err := data.GetString("access_ip")
-	if err == nil {
-		count := BaremetalagentManager.Query().Equals("access_ip", accessIp).
-			NotEquals("id", self.Id).Count()
-		if count > 0 {
-			return nil, httperrors.NewConflictError("Conflict access_ip %s", accessIp)
-		}
-	}
 	return self.SStandaloneResourceBase.ValidateUpdateData(ctx, userCred, query, data)
 }
 
@@ -96,11 +94,6 @@ func (manager *SBaremetalagentManager) ValidateCreateData(ctx context.Context, u
 	if count > 0 {
 		return nil, httperrors.NewDuplicateResourceError("Duplicate manager_uri %s", mangerUri)
 	}
-	//accessIp, _ := data.GetString("access_ip")
-	//count = manager.Query().Equals("access_ip", accessIp).Count()
-	//if count > 0 {
-	//	return nil, httperrors.NewDuplicateResourceError("Duplicate access_ip %s", accessIp)
-	//}
 	return manager.SStandaloneResourceBaseManager.ValidateCreateData(ctx, userCred, ownerProjId, query, data)
 }
 
diff --git a/pkg/compute/models/hosts.go b/pkg/compute/models/hosts.go
index 9eebeee4d8..727c07285f 100644
--- a/pkg/compute/models/hosts.go
+++ b/pkg/compute/models/hosts.go
@@ -1681,96 +1681,46 @@ func (self *SHost) getNetworkOfIPOnHost(ipAddr string) (*SNetwork, error) {
 	return net, nil
 }
 
-func (self *SHost) GetNetinterfaceWithNetworkAndCredential(netId string, userCred mcclient.TokenCredential, reserved bool) (*SNetInterface, *SNetwork) {
-	netif, net := self.getNetifWithNetworkAndCredential(netId, userCred, true, reserved)
-	if netif != nil {
-		return netif, net
+func (self *SHost) GetNetinterfaceWithIdAndCredential(netId string, userCred mcclient.TokenCredential, reserved bool) (*SNetInterface, *SNetwork) {
+	netObj, err := NetworkManager.FetchById(netId)
+	if err != nil {
+		return nil, nil
+	}
+	net := netObj.(*SNetwork)
+	if net.getFreeAddressCount() == 0 && !reserved {
+		return nil, nil
 	}
-	return self.getNetifWithNetworkAndCredential(netId, userCred, false, reserved)
-}
-
-func (self *SHost) getNetifWithNetworkAndCredential(netId string, userCred mcclient.TokenCredential, isPublic bool, reserved bool) (*SNetInterface, *SNetwork) {
 	netifs := self.GetNetInterfaces()
-	var maxFreeCnt = 0
-	var maxFreeNet *SNetwork
-	var maxFreeNetif *SNetInterface
 	for i := 0; i < len(netifs); i++ {
 		if !netifs[i].IsUsableServernic() {
 			continue
 		}
-		wire := netifs[i].GetWire()
-		if wire != nil {
-			if isPublic {
-				nets, _ := wire.getPublicNetworks()
-				for _, net := range nets {
-					if net.Id == netId || net.GetName() == netId {
-						freeCnt := net.getFreeAddressCount()
-						if maxFreeNet == nil || maxFreeCnt < freeCnt {
-							maxFreeNetif = &netifs[i]
-							maxFreeNet = &net
-						}
-					}
-				}
-			} else {
-				nets, _ := wire.getPrivateNetworks(userCred)
-				for _, net := range nets {
-					if net.Id == netId || net.GetName() == netId {
-						freeCnt := net.getFreeAddressCount()
-						if maxFreeNet == nil || maxFreeCnt < freeCnt {
-							maxFreeNetif = &netifs[i]
-							maxFreeNet = &net
-						}
-					}
-				}
-			}
+		if netifs[i].WireId == net.WireId {
+			return &netifs[i], net
 		}
 	}
-	return maxFreeNetif, maxFreeNet
+	return nil, nil
 }
 
 func (self *SHost) GetNetworkWithIdAndCredential(netId string, userCred mcclient.TokenCredential, reserved bool) (*SNetwork, error) {
-	net, err := self.getNetworkWithIdAndCredential(netId, userCred, true, reserved)
-	if err == nil {
-		return net, nil
-	}
-	return self.getNetworkWithIdAndCredential(netId, userCred, false, reserved)
-}
-
-func (self *SHost) getNetworkWithIdAndCredential(netId string, userCred mcclient.TokenCredential, isPublic bool, reserved bool) (*SNetwork, error) {
 	networks := NetworkManager.Query().SubQuery()
 	hostwires := HostwireManager.Query().SubQuery()
 	hosts := HostManager.Query().SubQuery()
 
 	q := networks.Query()
-	q = q.Join(hostwires, sqlchemy.AND(sqlchemy.Equals(hostwires.Field("wire_id"), networks.Field("wire_id")),
-		sqlchemy.IsFalse(hostwires.Field("deleted"))))
-	q = q.Join(hosts, sqlchemy.AND(sqlchemy.Equals(hosts.Field("id"), hostwires.Field("host_id")),
-		sqlchemy.IsFalse(hosts.Field("deleted"))))
+	q = q.Join(hostwires, sqlchemy.Equals(hostwires.Field("wire_id"), networks.Field("wire_id")))
+	q = q.Join(hosts, sqlchemy.Equals(hosts.Field("id"), hostwires.Field("host_id")))
 	q = q.Filter(sqlchemy.Equals(hosts.Field("id"), self.Id))
-	q = q.Filter(sqlchemy.OR(sqlchemy.Equals(networks.Field("id"), netId),
-		sqlchemy.Equals(networks.Field("name"), netId)))
-	if isPublic {
-		q = q.Filter(sqlchemy.IsTrue(networks.Field("is_public")))
-	} else {
-		q = q.Filter(sqlchemy.Equals(networks.Field("tenant_id"), userCred.GetProjectId()))
-	}
+	q = q.Filter(sqlchemy.Equals(networks.Field("id"), netId))
 
-	nets := make([]SNetwork, 0)
-	err := db.FetchModelObjects(NetworkManager, q, &nets)
+	net := SNetwork{}
+	net.SetModelManager(NetworkManager)
+	err := q.First(&net)
 	if err != nil {
 		return nil, err
 	}
-	var maxFreeNet *SNetwork
-	maxFrees := 0
-	for i := 0; i < len(nets); i += 1 {
-		freeCnt := nets[i].getFreeAddressCount()
-		if maxFreeNet == nil || maxFrees < freeCnt {
-			maxFrees = freeCnt
-			maxFreeNet = &nets[i]
-		}
-	}
-	if reserved || maxFrees > 0 {
-		return maxFreeNet, nil
+	if reserved || net.getFreeAddressCount() > 0 {
+		return &net, nil
 	}
 	return nil, fmt.Errorf("No IP address")
 }
diff --git a/pkg/compute/models/networks.go b/pkg/compute/models/networks.go
index 2f8db482dd..7e8a9e3a01 100644
--- a/pkg/compute/models/networks.go
+++ b/pkg/compute/models/networks.go
@@ -739,9 +739,18 @@ func parseNetworkInfo(userCred mcclient.TokenCredential, info jsonutils.JSONObje
 		} else {
 			netObj, err := NetworkManager.FetchByIdOrName(userCred, p)
 			if err != nil {
-				return nil, err
+				if err == sql.ErrNoRows {
+					return nil, httperrors.NewResourceNotFoundError2(NetworkManager.Keyword(), p)
+				} else {
+					return nil, err
+				}
+			}
+			net := netObj.(*SNetwork)
+			if net.IsOwner(userCred) || net.IsPublic || db.IsAdminAllowGet(userCred, net) {
+				netConfig.Network = netObj.GetId()
+			} else {
+				return nil, httperrors.NewForbiddenError("no allow to access network %s", p)
 			}
-			netConfig.Network = netObj.GetId()
 		}
 	}
 	if netConfig.BwLimit == 0 {