diff --git a/pkg/compute/models/vpcs.go b/pkg/compute/models/vpcs.go
index 4129576a53..4aed62bb13 100644
--- a/pkg/compute/models/vpcs.go
+++ b/pkg/compute/models/vpcs.go
@@ -1995,7 +1995,7 @@ func (self *SVpc) CheckSecurityGroupConsistent(secgroup *SSecurityGroup) error {
 	if secgroup.Status != api.SECGROUP_STATUS_READY {
 		return httperrors.NewInvalidStatusError("security group %s status is not ready", secgroup.Name)
 	}
-	if len(secgroup.ExternalId) == 0 {
+	if len(self.ExternalId) > 0 && len(secgroup.ExternalId) == 0 {
 		return httperrors.NewInvalidStatusError("The security group %s does not have an external id", secgroup.Name)
 	}
 	if len(secgroup.VpcId) > 0 {