Nokia is image based, so there's no real dependency here. But,first thing's first:
are you running a stand-alone installation?
This means, is the management database located on the same host? I always recommend a distributed installation. This way, you can do with the enforcement point as you like without having to worry about the management database.
Here's the basic order of operations:
1. Upgrade the management station to R61. See the notes on upgrades for this.
2. Upgrade the IPSO on the enforcement. You do this by downloading the latest and greatest code from
www.nokia.com/connect. Then, you use the command newimage for this.
3. Copy the NGX wrapper to the enforcement and use the command: newpkg -m LOCAL -n <NameofWrapper>.
4. Set the SIC and push the most recent policy and you are done. Go have a beer.
If the management is on the enforcement point, then you have to execute the same basic procedure as for an upgrade of management alone. The recommended way is to have a second machine that you install with the old version. Use the export command (search these forums for this) and import it to the second box. Then, shift the production to the second (now identical) box. You take the original offline, upgrade it using the proper procedure as outlined in the Check Point release notes/PDFs.