"Static" ARP entries is the more commonly used term than "Permanent"; you should know this if you're Googling and the like.
Static ARP entries do provide protection against ARP poisoning / spoofing. However, someone in a position to perform ARP spoofing can also perform MAC spoofing to achieve close to the same effect, and overcome the obstacle that a static ARP entry presents. This reduces the relative value of putting this protection into place.
Under both Windows and Unix, static arp entries are configured using the command line tool 'arp' which is often called from a script, as @chris points out. You will not find an easy distributed management mechanism like, say, Group Policy to do it for you. Unless you've already got a tool in place for centralized configuration (puppet, cfengine, BladeLogic) you're stuck with manual work, another reason this protection isn't as attractive as one might like.
In my opinion, static ARP entries are a low-level security step which has limited advantages, whose management is troublesome, and whose over-riding of the way a dynamic network works will turn around and bite you in the MAC at some point. There are better places to spend your time and energy.