diff --git a/pkg/multicloud/zstack/disk.go b/pkg/multicloud/zstack/disk.go
index af3a00465c..97dc6e44ca 100644
--- a/pkg/multicloud/zstack/disk.go
+++ b/pkg/multicloud/zstack/disk.go
@@ -54,7 +54,14 @@ type SDisk struct {
 
 func (region *SRegion) GetDisk(diskId string) (*SDisk, error) {
 	disk := &SDisk{region: region}
-	return disk, region.client.getResource("volumes", diskId, disk)
+	err := region.client.getResource("volumes", diskId, disk)
+	if err != nil {
+		return nil, err
+	}
+	if disk.Status == "NotInstantiated" || disk.Status == "Deleted" {
+		return nil, cloudprovider.ErrNotFound
+	}
+	return disk, nil
 }
 
 func (region *SRegion) GetDiskWithStorage(diskId string) (*SDisk, error) {
@@ -112,7 +119,7 @@ func (region *SRegion) GetDiskWithStorage(diskId string) (*SDisk, error) {
 
 func (region *SRegion) GetDisks(storageId string, diskIds []string, diskType string) ([]SDisk, error) {
 	disks := []SDisk{}
-	params := []string{}
+	params := []string{"q=status!=Deleted", "q=status!=NotInstantiated"}
 	if len(storageId) > 0 {
 		params = append(params, "q=primaryStorageUuid="+storageId)
 	}
diff --git a/pkg/multicloud/zstack/instance.go b/pkg/multicloud/zstack/instance.go
index 21eb9da543..43cd5e5dc8 100644
--- a/pkg/multicloud/zstack/instance.go
+++ b/pkg/multicloud/zstack/instance.go
@@ -62,12 +62,19 @@ type SInstance struct {
 
 func (region *SRegion) GetInstance(instanceId string) (*SInstance, error) {
 	instance := &SInstance{}
-	return instance, region.client.getResource("vm-instances", instanceId, instance)
+	err := region.client.getResource("vm-instances", instanceId, instance)
+	if err != nil {
+		return nil, err
+	}
+	if instance.State == "Destroyed" {
+		return nil, cloudprovider.ErrNotFound
+	}
+	return instance, nil
 }
 
 func (region *SRegion) GetInstances(hostId string, instanceId string, nicId string) ([]SInstance, error) {
 	instance := []SInstance{}
-	params := []string{"q=type=UserVm"}
+	params := []string{"q=type=UserVm", "q=state!=Destroyed"}
 	if len(hostId) > 0 {
 		params = append(params, "q=lastHostUuid="+hostId)
 	}
diff --git a/pkg/multicloud/zstack/securitygroup.go b/pkg/multicloud/zstack/securitygroup.go
index 79285b5ee7..ec3e005dc5 100644
--- a/pkg/multicloud/zstack/securitygroup.go
+++ b/pkg/multicloud/zstack/securitygroup.go
@@ -291,8 +291,18 @@ func (region *SRegion) syncSecgroupRules(secgroupId string, rules []secrules.Sec
 	}
 
 	if len(outRules) > 0 {
-		rule := secrules.MustParseSecurityRule("out:allow any")
-		outRules = append(outRules, *rule)
+		// 避免出现 {"error":{"class":"SYS.1007","code":503,"details":"rule should not be duplicated. rule dump: {\"type\":\"Egress\",\"ipVersion\":4,\"startPort\":-1,\"endPort\":-1,\"protocol\":\"ALL\",\"allowedCidr\":\"0.0.0.0/0\"}"}}
+		find := false
+		for _, _rule := range outRules {
+			if _rule.String() == "out:allow any" {
+				find = true
+				break
+			}
+		}
+		if !find {
+			rule := secrules.MustParseSecurityRule("out:allow any")
+			outRules = append(outRules, *rule)
+		}
 	}
 
 	rules = inRules.AllowList()