diff --git a/internal/services/paloalto/next_generation_firewall_vhub_local_rulestack_resource.go b/internal/services/paloalto/next_generation_firewall_vhub_local_rulestack_resource.go
index 8738da08bdd2..157c58b6b646 100644
--- a/internal/services/paloalto/next_generation_firewall_vhub_local_rulestack_resource.go
+++ b/internal/services/paloalto/next_generation_firewall_vhub_local_rulestack_resource.go
@@ -12,6 +12,7 @@ import (
 	"github.com/hashicorp/go-azure-helpers/resourcemanager/tags"
 	"github.com/hashicorp/go-azure-sdk/resource-manager/paloaltonetworks/2022-08-29/firewalls"
 	"github.com/hashicorp/go-azure-sdk/resource-manager/paloaltonetworks/2022-08-29/localrulestacks"
+	"github.com/hashicorp/terraform-provider-azurerm/internal/locks"
 	"github.com/hashicorp/terraform-provider-azurerm/internal/sdk"
 	"github.com/hashicorp/terraform-provider-azurerm/internal/services/paloalto/schema"
 	"github.com/hashicorp/terraform-provider-azurerm/internal/services/paloalto/validate"
@@ -79,7 +80,7 @@ func (r NextGenerationFirewallVHubLocalRuleStackResource) Attributes() map[strin
 
 func (r NextGenerationFirewallVHubLocalRuleStackResource) Create() sdk.ResourceFunc {
 	return sdk.ResourceFunc{
-		Timeout: 2 * time.Hour,
+		Timeout: 3 * time.Hour,
 		Func: func(ctx context.Context, metadata sdk.ResourceMetaData) error {
 			client := metadata.Client.PaloAlto.Client.Firewalls
 			localRuleStackClient := metadata.Client.PaloAlto.Client.LocalRulestacks
@@ -137,6 +138,9 @@ func (r NextGenerationFirewallVHubLocalRuleStackResource) Create() sdk.ResourceF
 				Tags: tags.Expand(model.Tags),
 			}
 
+			locks.ByID(ruleStackID.ID())
+			defer locks.UnlockByID(ruleStackID.ID())
+
 			if err = client.CreateOrUpdateThenPoll(ctx, id, firewall); err != nil {
 				return err
 			}
@@ -218,7 +222,7 @@ func (r NextGenerationFirewallVHubLocalRuleStackResource) Delete() sdk.ResourceF
 
 func (r NextGenerationFirewallVHubLocalRuleStackResource) Update() sdk.ResourceFunc {
 	return sdk.ResourceFunc{
-		Timeout: 2 * time.Hour,
+		Timeout: 3 * time.Hour,
 		Func: func(ctx context.Context, metadata sdk.ResourceMetaData) error {
 			client := metadata.Client.PaloAlto.Client.Firewalls
 
@@ -256,6 +260,8 @@ func (r NextGenerationFirewallVHubLocalRuleStackResource) Update() sdk.ResourceF
 				}
 
 				props.AssociatedRulestack = ruleStack
+				locks.ByID(ruleStackID.ID())
+				defer locks.UnlockByID(ruleStackID.ID())
 			}
 
 			if metadata.ResourceData.HasChange("network_profile") {
diff --git a/internal/services/paloalto/next_generation_firewall_vnet_local_rulestack_resource.go b/internal/services/paloalto/next_generation_firewall_vnet_local_rulestack_resource.go
index 123e6970065b..e6dfbe025237 100644
--- a/internal/services/paloalto/next_generation_firewall_vnet_local_rulestack_resource.go
+++ b/internal/services/paloalto/next_generation_firewall_vnet_local_rulestack_resource.go
@@ -12,6 +12,7 @@ import (
 	"github.com/hashicorp/go-azure-helpers/resourcemanager/tags"
 	"github.com/hashicorp/go-azure-sdk/resource-manager/paloaltonetworks/2022-08-29/firewalls"
 	"github.com/hashicorp/go-azure-sdk/resource-manager/paloaltonetworks/2022-08-29/localrulestacks"
+	"github.com/hashicorp/terraform-provider-azurerm/internal/locks"
 	"github.com/hashicorp/terraform-provider-azurerm/internal/sdk"
 	"github.com/hashicorp/terraform-provider-azurerm/internal/services/paloalto/schema"
 	"github.com/hashicorp/terraform-provider-azurerm/internal/services/paloalto/validate"
@@ -74,7 +75,7 @@ func (r NextGenerationFirewallVNetLocalRulestackResource) ResourceType() string
 
 func (r NextGenerationFirewallVNetLocalRulestackResource) Create() sdk.ResourceFunc {
 	return sdk.ResourceFunc{
-		Timeout: 2 * time.Hour,
+		Timeout: 3 * time.Hour,
 		Func: func(ctx context.Context, metadata sdk.ResourceMetaData) error {
 			client := metadata.Client.PaloAlto.Client.Firewalls
 			localRulestackClient := metadata.Client.PaloAlto.Client.LocalRulestacks
@@ -131,6 +132,9 @@ func (r NextGenerationFirewallVNetLocalRulestackResource) Create() sdk.ResourceF
 				Tags: tags.Expand(model.Tags),
 			}
 
+			locks.ByID(ruleStackID.ID())
+			defer locks.UnlockByID(ruleStackID.ID())
+
 			if err = client.CreateOrUpdateThenPoll(ctx, id, firewall); err != nil {
 				return fmt.Errorf("creating %s: %+v", id, err)
 			}
@@ -212,7 +216,7 @@ func (r NextGenerationFirewallVNetLocalRulestackResource) IDValidationFunc() plu
 
 func (r NextGenerationFirewallVNetLocalRulestackResource) Update() sdk.ResourceFunc {
 	return sdk.ResourceFunc{
-		Timeout: 2 * time.Hour,
+		Timeout: 3 * time.Hour,
 		Func: func(ctx context.Context, metadata sdk.ResourceMetaData) error {
 			client := metadata.Client.PaloAlto.Client.Firewalls
 
@@ -251,6 +255,8 @@ func (r NextGenerationFirewallVNetLocalRulestackResource) Update() sdk.ResourceF
 				}
 
 				props.AssociatedRulestack = ruleStack
+				locks.ByID(ruleStackID.ID())
+				defer locks.UnlockByID(ruleStackID.ID())
 			}
 
 			if metadata.ResourceData.HasChange("network_profile") {
diff --git a/website/docs/r/palo_alto_next_generation_firewall_vhub_local_rulestack.html.markdown b/website/docs/r/palo_alto_next_generation_firewall_vhub_local_rulestack.html.markdown
index 1f7f528fefff..592226c4d6cc 100644
--- a/website/docs/r/palo_alto_next_generation_firewall_vhub_local_rulestack.html.markdown
+++ b/website/docs/r/palo_alto_next_generation_firewall_vhub_local_rulestack.html.markdown
@@ -148,9 +148,9 @@ In addition to the Arguments listed above - the following Attributes are exporte
 
 The `timeouts` block allows you to specify [timeouts](https://www.terraform.io/language/resources/syntax#operation-timeouts) for certain actions:
 
-* `create` - (Defaults to 2 hours) Used when creating the Palo Alto Next Generation Firewall VHub Local Rulestack.
+* `create` - (Defaults to 3 hours) Used when creating the Palo Alto Next Generation Firewall VHub Local Rulestack.
 * `read` - (Defaults to 5 minutes) Used when retrieving the Palo Alto Next Generation Firewall VHub Local Rulestack.
-* `update` - (Defaults to 2 hours) Used when updating the Palo Alto Next Generation Firewall VHub Local Rulestack.
+* `update` - (Defaults to 3 hours) Used when updating the Palo Alto Next Generation Firewall VHub Local Rulestack.
 * `delete` - (Defaults to 2 hours) Used when deleting the Palo Alto Next Generation Firewall VHub Local Rulestack.
 
 ## Import
diff --git a/website/docs/r/palo_alto_next_generation_firewall_virtual_network_local_rulestack.html.markdown b/website/docs/r/palo_alto_next_generation_firewall_virtual_network_local_rulestack.html.markdown
index c179f025c7ef..04288e8663e9 100644
--- a/website/docs/r/palo_alto_next_generation_firewall_virtual_network_local_rulestack.html.markdown
+++ b/website/docs/r/palo_alto_next_generation_firewall_virtual_network_local_rulestack.html.markdown
@@ -217,9 +217,9 @@ In addition to the Arguments listed above - the following Attributes are exporte
 
 The `timeouts` block allows you to specify [timeouts](https://www.terraform.io/language/resources/syntax#operation-timeouts) for certain actions:
 
-* `create` - (Defaults to 2 hours) Used when creating the Palo Alto Next Generation Firewall Virtual Network Local Rulestack.
+* `create` - (Defaults to 3 hours) Used when creating the Palo Alto Next Generation Firewall Virtual Network Local Rulestack.
 * `read` - (Defaults to 5 minutes) Used when retrieving the Palo Alto Next Generation Firewall Virtual Network Local Rulestack.
-* `update` - (Defaults to 2 hours) Used when updating the Palo Alto Next Generation Firewall Virtual Network Local Rulestack.
+* `update` - (Defaults to 3 hours) Used when updating the Palo Alto Next Generation Firewall Virtual Network Local Rulestack.
 * `delete` - (Defaults to 2 hours) Used when deleting the Palo Alto Next Generation Firewall Virtual Network Local Rulestack.
 
 ## Import