If there is a firewall that can protect an infrastructure from ARP and DHCP poisoning attacks, are there any other protocols that I can spoof to poison the network?
ARP spoofing and DHCP spoofing can only take place within a broadcast domain, so no firewall will protect against them (except insofar as it helps keep malicious people off machines in the broadcast domain).
Other equivalent vulnerabilities, such as LLMNR and NBT-NS poisoning, are also limited to the broadcast domain. By definition, any spoofing attack which relies upon the victim making a broadcast for information is going to be local to the broadcast domain.
DNS spoofing is one form of spoofing that is not limited by the broadcast domain; getting a bad record in any upstream DNS server or cache is sufficient. Firewalls also lack any particular defense against this.