If two hosts are using a transparent IP level authentication and encryption, is their communication subject to both MITM or replay attacks?
1) Are replay attacks possible?
Yes. For example, if Alice wants to tell Bob "Pay Eve \$100", then P = "Pay Eve $100"
C = RC4(P, KEY)
Packet = IP(C | MD5(C|KEY) )
By capturing and replaying Packet, Eve can make Bob pay her \$100 over and over again.


2) Are Man-In-The-Middle attacks possible?
More specifically, "Is there a possibility to intercept messages and impersonate at-least one of the parties? Is it possible for the attacker to put himself between the sender and receiver by breaking the encryption?"

This question is more complicated. In short, it depends.

If the attacker gets hold of plaintext / ciphertext pairs for the RC4 (either through encryption oracle or decryption oracle), he simply takes P xor C to find the keystream. RC4 key reconstruction attacks can be used to find the MD5 key. The attacker may then act as a full MITM, intercepting and viewing messages and optionally modifying them before passing them on.

I am also uncomfortable with that MAC construction, so I'll get back to you on that one.