Hello,
stupid question maybe, but do you have IP routing enabled on the 3560 ?
Post the config of your switch. If you have a static IP address, correct subnet mask and default gateway that correspond to the Vlan 401 interface on the switch configured on your NVR, this should work...