diff --git a/pkg/compute/guestdrivers/azure.go b/pkg/compute/guestdrivers/azure.go
index d9e7a702e3..e7938829ec 100644
--- a/pkg/compute/guestdrivers/azure.go
+++ b/pkg/compute/guestdrivers/azure.go
@@ -17,6 +17,7 @@ import (
 
 	"yunion.io/x/jsonutils"
 	"yunion.io/x/onecloud/pkg/cloudcommon/db"
+	"yunion.io/x/onecloud/pkg/cloudcommon/db/lockman"
 	"yunion.io/x/onecloud/pkg/cloudcommon/db/taskman"
 	"yunion.io/x/onecloud/pkg/compute/models"
 )
@@ -322,6 +323,10 @@ func (self *SAzureGuestDriver) RequestSyncConfigOnHost(ctx context.Context, gues
 			if err != nil {
 				return nil, err
 			}
+
+			lockman.LockRawObject(ctx, "secgroupcache", fmt.Sprintf("%s-%s", guest.SecgrpId, vpcID))
+			defer lockman.ReleaseRawObject(ctx, "secgroupcache", fmt.Sprintf("%s-%s", guest.SecgrpId, vpcID))
+
 			secgroupCache := models.SecurityGroupCacheManager.Register(ctx, task.GetUserCred(), guest.SecgrpId, vpcID, host.GetRegion().Id, host.ManagerId)
 			if secgroupCache == nil {
 				return nil, fmt.Errorf("failed to registor secgroupCache for secgroup: %s vpc: %s", guest.SecgrpId, vpcID)
diff --git a/pkg/compute/guestdrivers/managedvirtual.go b/pkg/compute/guestdrivers/managedvirtual.go
index 5c28bb5240..c1b5849274 100644
--- a/pkg/compute/guestdrivers/managedvirtual.go
+++ b/pkg/compute/guestdrivers/managedvirtual.go
@@ -10,6 +10,7 @@ import (
 	"yunion.io/x/pkg/util/compare"
 	"yunion.io/x/pkg/util/secrules"
 
+	"yunion.io/x/onecloud/pkg/cloudcommon/db/lockman"
 	"yunion.io/x/onecloud/pkg/cloudcommon/db/taskman"
 	"yunion.io/x/onecloud/pkg/cloudprovider"
 	"yunion.io/x/onecloud/pkg/compute/models"
@@ -349,6 +350,10 @@ func (self *SManagedVirtualizedGuestDriver) RequestSyncConfigOnHost(ctx context.
 			if err != nil {
 				return nil, err
 			}
+
+			lockman.LockRawObject(ctx, "secgroupcache", fmt.Sprintf("%s-%s", guest.SecgrpId, vpcId))
+			defer lockman.ReleaseRawObject(ctx, "secgroupcache", fmt.Sprintf("%s-%s", guest.SecgrpId, vpcId))
+
 			secgroupCache := models.SecurityGroupCacheManager.Register(ctx, task.GetUserCred(), guest.SecgrpId, vpcId, host.GetRegion().Id, host.ManagerId)
 			if secgroupCache == nil {
 				return nil, fmt.Errorf("failed to registor secgroupCache for secgroup: %s vpc: %s", guest.SecgrpId, vpcId)
diff --git a/pkg/compute/guestdrivers/qcloud.go b/pkg/compute/guestdrivers/qcloud.go
index 64c5b5a47f..f2cb68b437 100644
--- a/pkg/compute/guestdrivers/qcloud.go
+++ b/pkg/compute/guestdrivers/qcloud.go
@@ -9,9 +9,11 @@ import (
 	"yunion.io/x/log"
 	"yunion.io/x/onecloud/pkg/httperrors"
 	"yunion.io/x/onecloud/pkg/mcclient"
+	"yunion.io/x/pkg/util/compare"
 	"yunion.io/x/pkg/utils"
 
 	"yunion.io/x/onecloud/pkg/cloudcommon/db"
+	"yunion.io/x/onecloud/pkg/cloudcommon/db/lockman"
 	"yunion.io/x/onecloud/pkg/cloudcommon/db/taskman"
 	"yunion.io/x/onecloud/pkg/cloudprovider"
 	"yunion.io/x/onecloud/pkg/compute/models"
@@ -348,6 +350,72 @@ func (self *SQcloudGuestDriver) OnGuestDeployTaskDataReceived(ctx context.Contex
 	return nil
 }
 
+func (self *SQcloudGuestDriver) RequestSyncConfigOnHost(ctx context.Context, guest *models.SGuest, host *models.SHost, task taskman.ITask) error {
+	taskman.LocalTaskRun(task, func() (jsonutils.JSONObject, error) {
+		ihost, err := host.GetIHost()
+		if err != nil {
+			return nil, err
+		}
+		iVM, err := ihost.GetIVMById(guest.ExternalId)
+		if err != nil {
+			return nil, err
+		}
+
+		if fwOnly, _ := task.GetParams().Bool("fw_only"); fwOnly {
+			iregion, err := host.GetIRegion()
+			if err != nil {
+				return nil, err
+			}
+			lockman.LockRawObject(ctx, "secgroupcache", fmt.Sprintf("%s-normal", guest.SecgrpId))
+			defer lockman.ReleaseRawObject(ctx, "secgroupcache", fmt.Sprintf("%s-normal", guest.SecgrpId))
+
+			secgroupCache := models.SecurityGroupCacheManager.Register(ctx, task.GetUserCred(), guest.SecgrpId, "normal", host.GetRegion().Id, host.ManagerId)
+			if secgroupCache == nil {
+				return nil, fmt.Errorf("failed to registor secgroupCache for secgroup: %s", guest.SecgrpId)
+			}
+			extID, err := iregion.SyncSecurityGroup(secgroupCache.ExternalId, "normal", guest.GetSecgroupName(), "", guest.GetSecRules())
+			if err != nil {
+				return nil, err
+			}
+			if err = secgroupCache.SetExternalId(extID); err != nil {
+				return nil, err
+			}
+			return nil, iVM.AssignSecurityGroup(extID)
+		}
+
+		iDisks, err := iVM.GetIDisks()
+		if err != nil {
+			return nil, err
+		}
+		disks := make([]models.SDisk, 0)
+		for _, guestdisk := range guest.GetDisks() {
+			disk := guestdisk.GetDisk()
+			disks = append(disks, *disk)
+		}
+
+		added := make([]models.SDisk, 0)
+		commondb := make([]models.SDisk, 0)
+		commonext := make([]cloudprovider.ICloudDisk, 0)
+		removed := make([]cloudprovider.ICloudDisk, 0)
+
+		if err := compare.CompareSets(disks, iDisks, &added, &commondb, &commonext, &removed); err != nil {
+			return nil, err
+		}
+		for _, disk := range removed {
+			if err := iVM.DetachDisk(disk.GetId()); err != nil {
+				return nil, err
+			}
+		}
+		for _, disk := range added {
+			if err := iVM.AttachDisk(disk.ExternalId); err != nil {
+				return nil, err
+			}
+		}
+		return nil, nil
+	})
+	return nil
+}
+
 func (self *SQcloudGuestDriver) AllowReconfigGuest() bool {
 	return true
 }