DSFW Group Types

A two way forest trust between DSFW and AD exists but can not add AD users to a DSFW group.

How do you make a group a domain local group, global group, or universal group?

The group needs to be a domain local group to add an AD user to a DSFW domain group when a two way forest trust is configured.  This is not a supported configuration but it has worked for many customers.
To determine the type of group check the value for the attribute groupType.
An easy way to check this is to edit the group object in iManager.  On the general tab click other, select groupType, and click edit. 
Below are the values for the tree different types of groups:

Domain Local group: -2147483644
Global group: -2147483646
Universal group: -2147483640

Slow logins can be a result of group type.  Global and Universal groups calculate a virtual attribute called tokenGroupsDomainLocal.  This attribute is calculated for the group by the slapi layer.  When a user is a member of several groups login times can increase.  An increase in ndsd utilization can also result from the calculation of the tokenGroupsDomainLocal when a large number of groups reside within the domain.

From the documentation

15.3 Limitations with Cross-Forest Trust

    Trust created between DSfW and Active Directory, will only permit the DSfW users to access the resources on the Active Directory domain. The users in the Active Directory domain cannot access the resources on the DSfW domain.