diff --git a/ui/index.jsp b/ui/index.jsp
index 000e539fd5d..c75d49a4342 100644
--- a/ui/index.jsp
+++ b/ui/index.jsp
@@ -179,7 +179,7 @@
             <div class="network" wizard-step-id="network">
               <!-- 5a: Network description -->
               <div class="wizard-step-conditional nothing-to-select">
-                <p>Either your selected hypervisor does not have any additional network features or you don't have any zone that has security group enabled.</p>
+                <p>Either you select a basic zone whose guest network does not include security group service or your selected hypervisor does not have any additional network features or you don't have any zone that has security group enabled.</p>
                 <p>Thus, no additional network features.</p>
                 <p>Please proceed to the next step.</p>
               </div>
diff --git a/ui/scripts/instances.js b/ui/scripts/instances.js
index d9c80d18ae9..31d55046931 100644
--- a/ui/scripts/instances.js
+++ b/ui/scripts/instances.js
@@ -206,14 +206,37 @@
                   if (selectedZoneObj.securitygroupsenabled == false) {  //show network container                    
                     step5ContainerType = 'select-network';
                   }
-                  else if (selectedZoneObj.securitygroupsenabled == true) {  // if security group is enabled                    
-                    if(selectedHypervisor == "VMware" || g_directAttachSecurityGroupsEnabled != "true")
+                  else if (selectedZoneObj.securitygroupsenabled == true) {  // if security group is enabled  
+                    var includingSecurityGroupService = false;
+                    $.ajax({
+                      url: createURL("listNetworks&trafficType=Guest&zoneId=" + selectedZoneObj.id),
+                      dataType: "json",
+                      async: false,
+                      success: function(json) {                        
+                        //basic zone should have only one guest network returned in this API call                        
+                        var items = json.listnetworksresponse.network;
+                        if(items != null && items.length > 0) {
+                          var networkObj = items[0];                          
+                          var serviceObjArray = networkObj.service;
+                          for(var k = 0; k < serviceObjArray.length; k++) {                            
+                            if(serviceObjArray[k].name == "SecurityGroup") {
+                              includingSecurityGroupService = true;
+                              break;
+                            }
+                          }                          
+                        }                        
+                      }
+                    });
+                                       
+                    if(includingSecurityGroupService == false || selectedHypervisor == "VMware" || g_directAttachSecurityGroupsEnabled != "true") { //???
                       step5ContainerType = 'nothing-to-select';
-                    else
-                      step5ContainerType = 'select-security-group';                    
+                    }
+                    else {
+                      step5ContainerType = 'select-security-group';    
+                    }                      
                   }
 
-                  //step5ContainerType = 'nothing-to-select'; //for testing only, comment it out before checking in!!!!!!!!!!!!
+                  //step5ContainerType = 'nothing-to-select'; //for testing only, comment it out before checking in
                   if(step5ContainerType == 'select-network') {
                     var defaultNetworkArray = [], optionalNetworkArray = [];
                     var networkData = {