So assuming that by "mutual SSL" you mean that each end of the connection will generate a set of SSL certificates and then they will validate each others certificate when the connection is brought up, issues like IP spoofing should not be a concern, as if an attacker is able to spoof the IP address (which is actually not a trivial undertaking for a TCP connection) they would not be able to complete the SSL handshake as they would lack the SSL private keys which match the certificates held by the other end.
Some things I can think of that you would need to consider with this set-up
- Initial communication of the certificates for each end of the connection. You need to ensure that these aren't tampered with in transit.
- Configuration of the SSL cipher suites on each end of the connection. You'll want to configure the servers at both ends of the connection to ensure that they don't support weak ciphers or deprecated protocols (some ideas for web servers here)
- You'll need to ensure that you have policies in place for revoking/re-issuing certificates when they expire or if there is a breach in the security of one of the servers.