diff --git a/src/acl/AclManager.cc b/src/acl/AclManager.cc
index 08fe240f4f..ca6752b029 100644
--- a/src/acl/AclManager.cc
+++ b/src/acl/AclManager.cc
@@ -91,7 +91,8 @@ AclManager::AclManager(
                     PoolObjectSQL::NET |
                     PoolObjectSQL::IMAGE |
                     PoolObjectSQL::TEMPLATE |
-                    PoolObjectSQL::DOCUMENT,
+                    PoolObjectSQL::DOCUMENT |
+                    PoolObjectSQL::SECGROUP,
                  AuthRequest::CREATE,
                  AclRule::INDIVIDUAL_ID |
                      zone_id,
diff --git a/src/vnm/VirtualNetwork.cc b/src/vnm/VirtualNetwork.cc
index aa2b43fb30..02809d68ae 100644
--- a/src/vnm/VirtualNetwork.cc
+++ b/src/vnm/VirtualNetwork.cc
@@ -211,7 +211,13 @@ int VirtualNetwork::insert(SqlDB * db, string& error_str)
     }
     else
     {
+        set<int> sgs;
+
         sg_str.append(",0");
+
+        one_util::split_unique(sg_str, ',', sgs);
+
+        sg_str = one_util::join(sgs.begin(), sgs.end(), ',');
     }
 
     add_template_attribute("SECURITY_GROUPS", sg_str);