ACS GroupFilter
From FrogspawnWiki
Cisco ACS can't handle too many groups in an LDAP query, if there are too many it will come back with a "Server timed out" error message.
To work around this you can edit the GroupObjectClass field to filter the groups that are returned from the query. If you enter the below, you'll only see the two specified groups.
group)(|(cn=GRP_TACACS_RW)(cn=GRP_TACACS_RO)