diff --git a/pkg/compute/models/secgroupcache.go b/pkg/compute/models/secgroupcache.go
index 41d785b68c..7f93963a30 100644
--- a/pkg/compute/models/secgroupcache.go
+++ b/pkg/compute/models/secgroupcache.go
@@ -123,6 +123,23 @@ func (manager *SSecurityGroupCacheManager) GetSecgroupCache(ctx context.Context,
 	return &secgroupCache
 }
 
+func (manager *SSecurityGroupCacheManager) CheckExist(ctx context.Context, userCred mcclient.TokenCredential, externalId, vpcId, regionId string, providerId string) (*SSecurityGroup, bool) {
+	secgroupCaches := []SSecurityGroupCache{}
+	query := manager.Query()
+	cond := sqlchemy.AND(sqlchemy.Equals(query.Field("external_id"), externalId), sqlchemy.Equals(query.Field("vpc_id"), vpcId), sqlchemy.Equals(query.Field("cloudregion_id"), regionId), sqlchemy.Equals(query.Field("manager_id"), providerId))
+	query = query.Filter(cond)
+
+	if err := query.All(&secgroupCaches); err != nil {
+		return nil, false
+	}
+	for _, secgroupCache := range secgroupCaches {
+		if secgroup, err := SecurityGroupManager.FetchById(secgroupCache.SecgroupId); err == nil {
+			return secgroup.(*SSecurityGroup), true
+		}
+	}
+	return nil, false
+}
+
 func (manager *SSecurityGroupCacheManager) Register(ctx context.Context, userCred mcclient.TokenCredential, secgroupId, vpcId, regionId string, providerId string) *SSecurityGroupCache {
 	lockman.LockClass(ctx, manager, userCred.GetProjectId())
 	defer lockman.ReleaseClass(ctx, manager, userCred.GetProjectId())
diff --git a/pkg/compute/models/secgroups.go b/pkg/compute/models/secgroups.go
index aa7ef6be88..e17f5502e7 100644
--- a/pkg/compute/models/secgroups.go
+++ b/pkg/compute/models/secgroups.go
@@ -218,7 +218,12 @@ func (self *SSecurityGroup) SyncWithCloudSecurityGroup(userCred mcclient.TokenCr
 	return nil
 }
 
-func (manager *SSecurityGroupManager) newFromCloudVpc(userCred mcclient.TokenCredential, extSec cloudprovider.ICloudSecurityGroup, vpc *SVpc) (*SSecurityGroup, error) {
+func (manager *SSecurityGroupManager) newFromCloudVpc(userCred mcclient.TokenCredential, extSec cloudprovider.ICloudSecurityGroup, vpc *SVpc) (*SSecurityGroup, bool, error) {
+	if secgroup, exist := SecurityGroupCacheManager.CheckExist(context.Background(), userCred, extSec.GetGlobalId(), extSec.GetVpcId(), vpc.CloudregionId, vpc.ManagerId); exist {
+		//避免重复同步
+		return secgroup, true, nil
+	}
+
 	secgroup := SSecurityGroup{}
 	secgroup.SetModelManager(manager)
 	secgroup.Name = extSec.GetName()
@@ -227,7 +232,7 @@ func (manager *SSecurityGroupManager) newFromCloudVpc(userCred mcclient.TokenCre
 	secgroup.ProjectId = userCred.GetProjectId()
 
 	if err := manager.TableSpec().Insert(&secgroup); err != nil {
-		return nil, err
+		return nil, false, err
 	}
 
 	if secgroupcache := SecurityGroupCacheManager.Register(context.Background(), userCred, secgroup.Id, extSec.GetVpcId(), vpc.CloudregionId, vpc.ManagerId); secgroupcache != nil {
@@ -236,7 +241,7 @@ func (manager *SSecurityGroupManager) newFromCloudVpc(userCred mcclient.TokenCre
 		}
 	}
 
-	return &secgroup, nil
+	return &secgroup, false, nil
 }
 
 func (manager *SSecurityGroupManager) SyncSecgroups(ctx context.Context, userCred mcclient.TokenCredential, secgroups []cloudprovider.ICloudSecurityGroup, vpc *SVpc) ([]SSecurityGroup, []cloudprovider.ICloudSecurityGroup, compare.SyncResult) {
@@ -280,11 +285,14 @@ func (manager *SSecurityGroupManager) SyncSecgroups(ctx context.Context, userCre
 			syncResult.AddError(err)
 			continue
 		}
-		new, err := manager.newFromCloudVpc(userCred, added[i], vpc)
+		new, exist, err := manager.newFromCloudVpc(userCred, added[i], vpc)
 		if err != nil {
 			syncResult.AddError(err)
 			continue
 		}
+		if exist {
+			continue
+		}
 		localSecgroups = append(localSecgroups, *new)
 		remoteSecgroups = append(remoteSecgroups, added[i])
 		SecurityGroupRuleManager.SyncRules(ctx, userCred, new, rules)