Raul, protection is provided by installation of surge arresters on the gen'r side of the grid-xfmr!
Typically, one set is located at the LV-terminals of the Grid-Xfmr, and a second set of special (expressly for machine-protection) at or nearer to the generator(s) terminals!
If connection between Xfmr and Gen'r is via cable, the length of line is critical. Also important is whether or not it is a single-machine or multiple machines!
BTW, modern Arresters have the ability to disconnect upon detection of its failure to recover from severe over-voltage; whether from a lightning-strikes to the grid, or network switching-transients!
