There is no universal defense against ARP spoofing. One possible defense is the use of static (non-changing) ARP entries. Since static entries cannot be updated, spoofed ARP replies are ignored. To prevent spoofing, the ARP tables would have to have a static entry for each machine on the network. The overhead in deploying these tables, as well as keeping them up to date, is not practical for most LANs, including those that incorporate Messaging systems.
Dividing the network into separate domains or subnets.
ARP spoofing cannot occur when the communicating devices are in different subnets. Media gateways and the IP telephones associated with those gateways can be administered in separate domains as much as is practical to provide some deterrence to ARP spoofing.